UBUNTU-CVE-2026-68162

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid authenable sysctl UAF during netns teardown procsctpdoauth updates the SCTP control socket after changing net.sctp.authenable. The handler gets the per-net SCTP state from ctl-data, so an already opened sysctl file ca...

UBUNTU-CVE-2026-68161

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restarts them when the sysctl value changes. The netns exit path does not st...

CVE-2026-68161

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restarts them when the sysctl value changes. The netns exit path does not st...

CVE-2026-68320

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authchunklist capacity check in sctpauthepaddchunkid sctpauthepaddchunkid uses SCTPNUMCHUNKTYPES 20 as the capacity limit for ep-authchunklist, allowing it to hold up to 20 chunk entries paramhdr.length up to 24. Howeve...

CVE-2026-68315

In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctpprocessstrresetinreq When processing a RESETINREQUEST from a peer, sctpprocessstrresetinreq derives the stream count from the parameter length but does not check whether the resulting...

UBUNTU-CVE-2026-68376

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authhmacs array size in struct sctpcookie The authhmacs array in struct sctpcookie is supposed to store a complete SCTPAUTHHMACALGO parameter, which consists of a struct sctpparamhdr followed by N HMAC identifiers...

UBUNTU-CVE-2026-68300

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping authentication. This is incorrect when: 1. skbclone failed in the BH...

CVE-2026-68376 sctp: fix auth_hmacs array size in struct sctp_cookie

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authhmacs array size in struct sctpcookie The authhmacs array in struct sctpcookie is supposed to store a complete SCTPAUTHHMACALGO parameter, which consists of a struct sctpparamhdr followed by N HMAC identifiers...

CVE-2026-68376 sctp: fix auth_hmacs array size in struct sctp_cookie

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authhmacs array size in struct sctpcookie The authhmacs array in struct sctpcookie is supposed to store a complete SCTPAUTHHMACALGO parameter, which consists of a struct sctpparamhdr followed by N HMAC identifiers...

CVE-2026-68376

The CVE-2026-68376 issue concerns the Linux kernel SCTP implementation. A miscalculated auth_hmacs array size in struct sctp_cookie caused the HMAC-ALGO parameter (struct sctp_paramhdr plus N HMAC identifiers) to overflow the buffer when four identifiers are configured, leading to copying beyond ...

CVE-2026-68320 sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authchunklist capacity check in sctpauthepaddchunkid sctpauthepaddchunkid uses SCTPNUMCHUNKTYPES 20 as the capacity limit for ep-authchunklist, allowing it to hold up to 20 chunk entries paramhdr.length up to 24. Howeve...

CVE-2026-68320

CVE-2026-68320 concerns the Linux kernel SCTP implementation. The issue arises in sctp_auth_ep_add_chunkid, which uses SCTP_NUM_CHUNK_TYPES (20) as the capacity limit for ep->auth_chunk_list, while the destination in sctp_cookie/gathered state only holds SCTP_AUTH_MAX_CHUNKS (16) entries. When...

CVE-2026-68315

Summary (CVE-2026-68315) : In the Linux kernel SCTP implementation, processing a RESET_IN_REQUEST from a peer can derive a stream count from the parameter length and then exceed SCTP_MAX_CHUNK_LEN when constructing the corresponding RESET_OUT_REQUEST. The OUT header is 16 bytes vs IN header 8 byt...

EUVD-2026-55416

In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctpprocessstrresetinreq When processing a RESETINREQUEST from a peer, sctpprocessstrresetinreq derives the stream count from the parameter length but does not check whether the resulting...

CVE-2026-68315 sctp: validate stream count in sctp_process_strreset_inreq()

In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctpprocessstrresetinreq When processing a RESETINREQUEST from a peer, sctpprocessstrresetinreq derives the stream count from the parameter length but does not check whether the resulting...

CVE-2026-68300 sctp: auth: verify auth requirement when auth_chunk is NULL

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping authentication. This is incorrect when: 1. skbclone failed in the BH...

CVE-2026-68162 sctp: avoid auth_enable sysctl UAF during netns teardown

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid authenable sysctl UAF during netns teardown procsctpdoauth updates the SCTP control socket after changing net.sctp.authenable. The handler gets the per-net SCTP state from ctl-data, so an already opened sysctl file ca...

CVE-2026-68162

CVE-2026-68162 is a Linux kernel SCTP vulnerability (local) where a Use-After-Free can occur during netns teardown due to an auth_enable sysctl window. The bug stems from SCTP’s per-net sysctl state being registered before the control socket is fully established and remaining writable after inet_...

EUVD-2026-55548

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid authenable sysctl UAF during netns teardown procsctpdoauth updates the SCTP control socket after changing net.sctp.authenable. The handler gets the per-net SCTP state from ctl-data, so an already opened sysctl file ca...

CVE-2026-68161 sctp: close UDP tunnel sockets during netns teardown

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restarts them when the sysctl value changes. The netns exit path does not st...