CVE-2026-68300 sctp: auth: verify auth requirement when auth_chunk is NULL
Attackers can bypass SCTP authentication checks when auth_chunk is NULL, allowing unauthorized connection establishment or data injection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68300?
CVE-2026-68300 is a critical authentication bypass vulnerability in Linux, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sctp: auth: verify auth requirement when auth_chunk is NULL
sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL, silently skipping authentication. This is incorrect when:
1. skb_clone() failed in the BH receive path, leaving auth_chunk NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new connections, so the early sctp_auth_recv_cid() check cannot catch this.
2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never called and auth_chunk remains NULL.
Fix by checking sctp_auth_recv_cid() when auth_chunk is NULL: if authentication is required, return false to drop the chunk; otherwise continue normally.
Weakness: CWE-287
Which versions are affected by CVE-2026-68300?
How do I fix CVE-2026-68300?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-68300 being exploited?
There is no known exploitation of CVE-2026-68300 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68300, DEBIAN-CVE-2026-68300, GHSA-438p-hr89-q323, UBUNTU-CVE-2026-68300.