Bug 2513408 (CVE-2026-68300)

Summary: CVE-2026-68300 kernel: sctp: auth: verify auth requirement when auth_chunk is NULL
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Stream Control Transmission Protocol (SCTP) authentication mechanism within the Linux kernel. The `sctp_auth_chunk_verify()` function incorrectly processes authentication chunks, leading to authentication requirements being silently bypassed. This can occur under specific conditions, such as when memory allocation fails or when an authentication chunk is missing before a COOKIE-ECHO message. An attacker could potentially exploit this to bypass intended security controls.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-10 12:35:41 UTC 
In the Linux kernel, the following vulnerability has been resolved:

sctp: auth: verify auth requirement when auth_chunk is NULL

sctp_auth_chunk_verify() returns true unconditionally when
chunk->auth_chunk is NULL, silently skipping authentication.
This is incorrect when:

1. skb_clone() failed in the BH receive path, leaving auth_chunk
   NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new
   connections, so the early sctp_auth_recv_cid() check cannot
   catch this.

2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never
   called and auth_chunk remains NULL.

Fix by checking sctp_auth_recv_cid() when auth_chunk is NULL:
if authentication is required, return false to drop the chunk;
otherwise continue normally.
Comment 1 gkamathe 2026-08-11 15:34:01 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081029-CVE-2026-68300-ab03@gregkh/T