Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_hmacs array size in struct sctp_cookie The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed by N HMAC identifiers. However, the array size was calculated using an extra 2 bytes instead of sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers are configured, the HMAC-ALGO parameter stored in the endpoint is larger than the auth_hmacs buffer in the cookie. As a result, sctp_association_init() copies beyond the end of auth_hmacs when initializing the association, corrupting the adjacent auth_chunks field. This can lead to an invalid HMAC identifier being accepted and later cause an out-of-bounds read in sctp_auth_get_hmac(). Fix the array size calculation by including the full SCTP parameter header size.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026081043-CVE-2026-68376-5dfa@gregkh/T
Public PoC/exploit code for CVE-2026-68376 has been released. Red Hat CVE: https://access.redhat.com/security/cve/cve-2026-68376 Public exploit: Ubuntu 7.0.0-30: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-68376-Ubuntu-7.0.0-30 Impact summary: CVE-2026-68376 affects the Linux SCTP subsystem and may allow an attacker to trigger a kernel memory-safety condition through crafted SCTP traffic. Depending on the exact execution path and system configuration, successful exploitation could result in a kernel crash or other security impact. Systems with SCTP enabled and exposed to untrusted network traffic should be considered at higher risk. Possible backport patches: RHEL 6 through RHEL 9: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0b4414e43e0861d67276031cc21401d7e87de3da RHEL 10: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d0a59ba58578e2b330fff80a44fe519f3ba7d8c7 Possible mitigation for systems that do not require SCTP: echo "install sctp /bin/true" > /etc/modprobe.d/disable-sctp.conf This mitigation should only be used on systems where SCTP functionality is not required. Please review the affected RHEL releases, the current impact assessment, and whether disabling the SCTP kernel module can be documented as a mitigation now that public exploit code is available.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:66324 https://access.redhat.com/errata/RHSA-2026:66324
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:66325 https://access.redhat.com/errata/RHSA-2026:66325
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:67150 https://access.redhat.com/errata/RHSA-2026:67150