CVE-2026-68376: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68376 is a buffer overflow vulnerability in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation, specifically in the auth_hmacs array size calculation within struct sctp_cookie. The flaw causes sctp_association_init() to copy beyond the end of the auth_hmacs buffer when four HMAC identifiers are configured, corrupting the adjacent auth_chunks field and potentially enabling an out-of-bounds read in sctp_auth_get_hmac(). The vulnerability has been present since Linux kernel 2.6.24 and was disclosed on August 10, 2026. Fixed versions include Linux 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4. The CVSS base score is currently listed as 0.0 (pending full scoring), with Feedly estimating severity as HIGH (GitHub Advisory, Feedly).

The root cause is an incorrect buffer size calculation (CWE-131: Incorrect Calculation of Buffer Size / CWE-125: Out-of-bounds Read) in the auth_hmacs array within struct sctp_cookie. The array was sized using 2 extra bytes instead of sizeof(struct sctp_paramhdr) (which is 4 bytes), making the buffer 2 bytes too small to hold a complete SCTP_AUTH_HMAC_ALGO parameter when four HMAC identifiers are configured. When sctp_association_init() copies the HMAC-ALGO parameter into this undersized buffer, it overflows into the adjacent auth_chunks field, corrupting it. A corrupted auth_chunks field can cause an invalid HMAC identifier to be accepted during authentication validation, subsequently triggering an out-of-bounds read in sctp_auth_get_hmac(). Exploitation requires local access and the ability to configure SCTP authentication parameters (GitHub Advisory, Feedly).

Successful exploitation allows a local user with the ability to configure SCTP authentication parameters to corrupt adjacent kernel memory structures (auth_chunks field) and trigger an out-of-bounds read of kernel memory, constituting a memory disclosure vulnerability. The primary impact is on confidentiality (kernel memory exposure) and integrity (memory corruption of kernel data structures). While the vulnerability does not directly enable remote code execution, kernel memory disclosure could potentially be leveraged as part of a broader privilege escalation chain (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The vulnerability requires local access to configure SCTP authentication parameters, significantly limiting the attack surface. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

Apply the kernel patch that corrects the auth_hmacs array size calculation in struct sctp_cookie to use sizeof(struct sctp_paramhdr) (4 bytes) instead of 2 bytes. Fixed versions are available: Linux 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4 or later. As a workaround where upgrading is not immediately possible, disabling SCTP authentication (if not required by the deployment) or limiting local user privileges to prevent configuration of SCTP parameters can reduce exposure (GitHub Advisory, Feedly).