CVE-2026-68320

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The overflow condition can only be created locally: an attacker must call setsockopt(SCTP_AUTH_SUPPORTED) and then setsockopt(SCTP_AUTH_CHUNK) more than 16 times on an SCTP socket they own. A remote peer can trigger the memcpy by connecting to such a socket, but cannot itself populate the oversized chunk list.

AC:LAttack complexity, low

The sequence is fully deterministic and entirely under attacker control — enable AUTH, add 17-20 distinct chunk IDs, then create an association via connect() or accept(); no race, timing window, or memory-layout condition is involved.

PR:LPrivileges required, low

Creating an IPPROTO_SCTP socket and issuing SCTP_AUTH_SUPPORTED/SCTP_AUTH_CHUNK setsockopts requires no capability; sctp_setsockopt_auth_supported() enables AUTH per-endpoint regardless of the net.sctp.auth_enable sysctl, so any unprivileged local user reaches the bug.

UI:NUser interaction, none

The attacker performs every step from their own process — socket setup, setsockopt calls, and association establishment — with no action required from any other user or administrator.

S:UScope, unchanged

The corruption and the over-read are confined to the kernel's own SCTP association object; no other security authority or privilege domain is crossed.

C:LConfidentiality impact, low

sctp_make_init()/sctp_make_init_ack() copy ntohs(auth_chunks->length) bytes from the 20-byte field, emitting up to 4 bytes past it (the adjacent raw_addr_list_len) inside the CHUNKS parameter of INIT/INIT-ACK sent to the remote peer — a real but small, strictly bounded out-of-bounds read.

I:HIntegrity impact, high

sctp_association_init() writes up to 4 bytes of fully attacker-chosen data (the chunk-ID values) past the end of asoc->c.auth_chunks into the adjacent kernel struct field, an out-of-bounds write of controlled content into kernel memory.

A:HAvailability impact, high

On CONFIG_FORTIFY_SOURCE kernels the memcpy is flagged as a field-spanning write and emits a WARN, which is fatal on the widely used panic_on_warn configurations, and the out-of-bounds write itself corrupts SCTP association state; the trigger is cheap and repeatable by any local user.