kernel: sctp: auth: verify auth requirement when auth_chunk is NULL

A flaw was found in the Stream Control Transmission Protocol SCTP authentication mechanism within the Linux kernel. The sctpauthchunkverify function incorrectly processes authentication chunks, leading to authentication requirements being silently bypassed. This can occur under specific condition...

CVE-2026-74752

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-68320

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authchunklist capacity check in sctpauthepaddchunkid sctpauthepaddchunkid uses SCTPNUMCHUNKTYPES 20 as the capacity limit for ep-authchunklist, allowing it to hold up to 20 chunk entries paramhdr.length up to 24. Howeve...

CVE-2026-68300

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping authentication. This is incorrect when: 1. skbclone failed in the BH...

CVE-2026-68320

CVE-2026-68320 concerns the Linux kernel SCTP implementation. The issue arises in sctp_auth_ep_add_chunkid, which uses SCTP_NUM_CHUNK_TYPES (20) as the capacity limit for ep->auth_chunk_list, while the destination in sctp_cookie/gathered state only holds SCTP_AUTH_MAX_CHUNKS (16) entries. When...

EUVD-2026-55421

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authchunklist capacity check in sctpauthepaddchunkid sctpauthepaddchunkid uses SCTPNUMCHUNKTYPES 20 as the capacity limit for ep-authchunklist, allowing it to hold up to 20 chunk entries paramhdr.length up to 24. Howeve...

CVE-2026-68320 sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authchunklist capacity check in sctpauthepaddchunkid sctpauthepaddchunkid uses SCTPNUMCHUNKTYPES 20 as the capacity limit for ep-authchunklist, allowing it to hold up to 20 chunk entries paramhdr.length up to 24. Howeve...

EUVD-2026-55401

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping authentication. This is incorrect when: 1. skbclone failed in the BH...

CVE-2026-68300

Summary: CVE-2026-68300 in the Linux kernel concerns SCTP authentication. The function sctp_auth_chunk_verify() incorrectly returns true when auth_chunk is NULL, allowing authentication to be bypassed under certain conditions (e.g., skb_clone() failure in BH path or absence of an AUTH before COOK...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002409)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002409 advisory. The sctpsfdo51Dce function in net/sctp/smstatefuns.c in the Linux kernel through 3.13.6 does not validate certain authenable and authcapable fields before making an...

usrsctp: Buffer overflow in AUTH chunk input validation

A flaw was found in Mozilla Firefox and Thunderbird. When parsing and validating SCTP chunks in WebRTC a memory buffer overflow could occur leading to memory corruption and an exploitable crash. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

Important: Red Hat Security Advisory: chromium-browser security update

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

usrsctp: Buffer overflow in AUTH chunk input validation

A flaw was found in Mozilla Firefox and Thunderbird. When parsing and validating SCTP chunks in WebRTC a memory buffer overflow could occur leading to memory corruption and an exploitable crash. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

usrsctp: Buffer overflow in AUTH chunk input validation

A flaw was found in Mozilla Firefox and Thunderbird. When parsing and validating SCTP chunks in WebRTC a memory buffer overflow could occur leading to memory corruption and an exploitable crash. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

usrsctp: Buffer overflow in AUTH chunk input validation

A flaw was found in Mozilla Firefox and Thunderbird. When parsing and validating SCTP chunks in WebRTC a memory buffer overflow could occur leading to memory corruption and an exploitable crash. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

RHEL 6 : chromium-browser (RHSA-2020:2064)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2064 advisory. Chromium is an open-source web browser, powered by WebKit Blink. This update upgrades Chromium to version 81.0.4044.138. Security Fixes:...

usrsctp: Buffer overflow in AUTH chunk input validation

A flaw was found in Mozilla Firefox and Thunderbird. When parsing and validating SCTP chunks in WebRTC a memory buffer overflow could occur leading to memory corruption and an exploitable crash. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

RHEL 8 : firefox (RHSA-2020:2031)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2031 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

CVE-2014-0101

The sctpsfdo51Dce function in net/sctp/smstatefuns.c in the Linux kernel through 3.13.6 does not validate certain authenable and authcapable fields before making an sctpsfauthenticate call, which allows remote attackers to cause a denial of service NULL pointer dereference and system crash via an...

Null pointer dereference

The sctpsfdo51Dce function in net/sctp/smstatefuns.c in the Linux kernel through 3.13.6 does not validate certain authenable and authcapable fields before making an sctpsfauthenticate call, which allows remote attackers to cause a denial of service NULL pointer dereference and system crash via an...