CVE-2026-68376

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SCTP implementation where the auth hmacs array within struct sctp cookie is incorrectly sized. The array is intended to store a complete SCTP AUTH HMAC ALGO parameter, comprising a struct sctp paramhdr and several HMAC identifiers. Due to a calculation error using 2 bytes instead of the 4-byte sizeof(struct sctp paramhdr), the buffer is too small when four HMAC identifiers are configured. Consequently, the sctp association init() function copies data beyond the auth hmacs boundary, corrupting the auth chunks field. This corruption can lead to the acceptance of invalid HMAC identifiers and subsequently trigger an out-of-bounds read in the sctp auth get hmac() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.