CVE-2026-68300
Description
A flaw was found in the Stream Control Transmission Protocol (SCTP) authentication mechanism within the Linux kernel. The sctp_auth_chunk_verify() function incorrectly processes authentication chunks, leading to authentication requirements being silently bypassed. This can occur under specific conditions, such as when memory allocation fails or when an authentication chunk is missing before a COOKIE-ECHO message. An attacker could potentially exploit this to bypass intended security controls.
Statement
A flaw in the Linux kernel Stream Control Transmission Protocol (SCTP) authentication handling, rated MODERATE by Red Hat, affects the kernel and kernel-rt components in Red Hat Enterprise Linux 6 through 10 (including ELS and z-stream update streams) as well as kernel components in Red Hat In-Vehicle OS. The sctp_auth_chunk_verify() function returns true unconditionally when chunk->auth_chunk is NULL, so SCTP authentication requirements can be silently skipped when skb_clone() fails in the bottom-half receive path or when no AUTH chunk precedes a COOKIE-ECHO chunk. Under those conditions, an attacker able to deliver crafted SCTP traffic to a system that enforces SCTP chunk authentication could have unauthenticated chunks processed as authenticated, compromising the integrity of SCTP associations. Red Hat's MODERATE rating reflects the high attack complexity and specific preconditions required for exploitation, which differs meaningfully from the CRITICAL (CVSS 9.8) severity assigned in the upstream CVE record. A fix is being pursued for the affected Red Hat products through the delegated kernel maintenance process.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 9.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
