CVE-2026-68376: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68376 Overview

CVE-2026-68376 is a memory corruption vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The auth_hmacs array in struct sctp_cookie was sized using an incorrect calculation that reserved only 2 bytes for the SCTP parameter header instead of the required 4 bytes (sizeof(struct sctp_paramhdr)). When four HMAC identifiers are configured, sctp_association_init() copies data beyond the end of the auth_hmacs buffer, corrupting the adjacent auth_chunks field. The corruption allows an invalid HMAC identifier to be accepted and can trigger an out-of-bounds read in sctp_auth_get_hmac().

Critical Impact
Remote attackers can trigger memory corruption in the Linux kernel SCTP stack, leading to out-of-bounds reads that impact confidentiality, integrity, and availability of the host.

Affected Products

Linux kernel with SCTP support enabled
Distributions and stable branches prior to the fix commits
Systems using SCTP authentication with multiple HMAC identifiers configured

Discovery Timeline

2026-08-10 - CVE-2026-68376 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68376

Vulnerability Analysis

The defect resides in the SCTP subsystem of the Linux kernel, specifically in the sizing of the auth_hmacs buffer within struct sctp_cookie. The buffer is intended to hold a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed by a variable number of HMAC identifiers. The original size calculation reserved only 2 bytes for the parameter header, while struct sctp_paramhdr is 4 bytes in size.

When an endpoint negotiates four HMAC identifiers, the stored HMAC-ALGO parameter exceeds the allocated auth_hmacs buffer by 2 bytes. During association initialization, sctp_association_init() performs a copy operation that overruns the buffer and overwrites the adjacent auth_chunks field. The corruption is silent at the moment of the overwrite but produces observable follow-on effects.

Root Cause

The root cause is an incorrect constant used when computing the size of the auth_hmacs array. The code assumed the SCTP parameter header was 2 bytes when it is in fact 4 bytes. This off-by-two error violates the invariant that the destination buffer must be at least as large as the source parameter. The fix, distributed across multiple stable kernel commits, replaces the hardcoded value with sizeof(struct sctp_paramhdr) to guarantee correct sizing.

Attack Vector

The vulnerability is reachable over the network through the SCTP protocol without authentication or user interaction. An attacker who can establish an SCTP association with a target and negotiate an HMAC-ALGO parameter containing enough identifiers can trigger the overflow. Once the auth_chunks field is corrupted, subsequent lookups by sctp_auth_get_hmac() can accept an invalid HMAC identifier and perform out-of-bounds reads on kernel memory. The high attack complexity reflects the specific configuration and timing required to trigger the copy path.

No verified proof-of-concept code is publicly available. See the upstream fix commits for technical details: Kernel Git Commit 0b4414e, Kernel Git Commit 3aa40c3b, Kernel Git Commit a8d20ba0, Kernel Git Commit d0a59ba5, and Kernel Git Commit e0b5252a.

Detection Methods for CVE-2026-68376

Indicators of Compromise

Unexpected kernel warnings or oops messages referencing sctp_association_init or sctp_auth_get_hmac
KASAN reports flagging out-of-bounds reads in the SCTP authentication code path
Anomalous SCTP INIT or COOKIE-ECHO chunks containing HMAC-ALGO parameters with four or more identifiers from untrusted peers

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test builds to catch the out-of-bounds access during SCTP association setup
Compare running kernel versions against the fixed stable release commits listed in the vendor advisories
Inspect SCTP traffic for HMAC-ALGO parameters carrying an unusually high number of HMAC identifiers

Monitoring Recommendations

Forward kernel logs (dmesg, journald) to a centralized log store and alert on SCTP subsystem warnings
Monitor for kernel panics or unexpected reboots on hosts exposing SCTP endpoints
Track SCTP endpoint configurations and audit the set of negotiated authentication algorithms across the fleet

How to Mitigate CVE-2026-68376

Immediate Actions Required

Apply the upstream kernel patches referenced in the fix commits and reboot affected hosts
Inventory systems exposing SCTP services (telecom signaling, WebRTC data channels, diameter, M3UA) and prioritize them for patching
Restrict SCTP traffic at network boundaries to trusted peers until patches are deployed

Patch Information

The fix corrects the size calculation for auth_hmacs in struct sctp_cookie to include the full sizeof(struct sctp_paramhdr). It has been backported to multiple stable branches through the following commits: 0b4414e43e08, 3aa40c3bccac, a8d20ba0ab51, d0a59ba58578, and e0b5252a5938. Consult your distribution's security advisory for the exact package version containing the backport.

Workarounds

Disable the SCTP kernel module on systems that do not require it by blacklisting sctp in /etc/modprobe.d/
Disable SCTP authentication (net.sctp.auth_enable = 0) if operational requirements permit, to remove the vulnerable code path
Apply host-based firewall rules to block inbound SCTP (IP protocol 132) from untrusted networks

bash

# Disable loading of the SCTP kernel module
echo 'install sctp /bin/true' | sudo tee /etc/modprobe.d/disable-sctp.conf

# Verify SCTP is not loaded
lsmod | grep sctp

# Alternatively, disable SCTP authentication at runtime
sudo sysctl -w net.sctp.auth_enable=0