CVE-2026-68376 sctp: fix auth_hmacs array size in struct sctp_cookie
A buffer overflow in the Linux kernel SCTP implementation allows attackers to corrupt memory, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68376?
CVE-2026-68376 is a high-severity memory corruption vulnerability in Linux, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix auth_hmacs array size in struct sctp_cookie
The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed by N HMAC identifiers.
However, the array size was calculated using an extra 2 bytes instead of sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers are configured, the HMAC-ALGO parameter stored in the endpoint is larger than the auth_hmacs buffer in the cookie.
As a result, sctp_association_init() copies beyond the end of auth_hmacs when initializing the association, corrupting the adjacent auth_chunks field. This can lead to an invalid HMAC identifier being accepted and later cause an out-of-bounds read in sctp_auth_get_hmac().
Fix the array size calculation by including the full SCTP parameter header size.
Weakness: CWE-787
Which versions are affected by CVE-2026-68376?
How do I fix CVE-2026-68376?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-68376 being exploited?
There is no known exploitation of CVE-2026-68376 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as BELL-CVE-2026-68376, DEBIAN-CVE-2026-68376, GHSA-55hr-9mvf-6m8f, UBUNTU-CVE-2026-68376.