SCTP Auth HMAC Buffer Overflow in Linux Kernel
CVE-2026-68376
Key Information:
Badges
What is CVE-2026-68376?
A vulnerability in the Linux kernel's SCTP implementation allows for a buffer overflow due to an incorrect calculation of the auth_hmacs array size in the struct sctp_cookie. This miscalculation leads to the potential for corrupting adjacent memory, which can allow invalid HMAC identifiers to be accepted. Consequently, this can result in out-of-bounds reads in the sctp_auth_get_hmac() function, jeopardizing the integrity of data transmitted over the SCTP protocol.
Affected Version(s)
Linux 1f485649f52929d9937b346a920a522a7363e202 < 317731d01b03c529809df36d3a7d149677a8729d
Linux 1f485649f52929d9937b346a920a522a7363e202 < 0528485f27016a42804abe01aa61b39d85fa803e
Linux 1f485649f52929d9937b346a920a522a7363e202
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.