CVE-2026-68315

Status: UPDATED  |  Advisory ID: CVE-2026-68315

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate stream count in sctp_process_strreset_inreq()

When processing a RESET_IN_REQUEST from a peer,

sctp_process_strreset_inreq() derives the stream count from the

parameter length but does not check whether the resulting

RESET_OUT_REQUEST would exceed SCTP_MAX_CHUNK_LEN.

The OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes

larger than the IN request header (sctp_strreset_inreq, 8 bytes).

Generally, the IP payload is bounded to 65535 bytes, so the stream

list cannot be large enough to trigger the overflow. However, on

interfaces with MTU > 65535 (e.g., loopback with IPv6 jumbograms), a

stream list that fits within the incoming IN parameter can cause a

__u16 overflow in sctp_make_strreset_req() when computing the OUT

request size, leading to an undersized skb allocation and a kernel

BUG:

net/core/skbuff.c:207 skb_panic

net/core/skbuff.c:2625 skb_put

net/sctp/sm_make_chunk.c:1535 sctp_addto_chunk

net/sctp/sm_make_chunk.c:3695 sctp_make_strreset_req

net/sctp/stream.c:655 sctp_process_strreset_inreq

The local setsockopt path validates the generated reset request size.

However, for an incoming-only reset, it accounts for the smaller IN

request even though the peer must generate an OUT request with the same

stream list. Such a request cannot be completed successfully by the

peer.

Reject peer IN requests whose corresponding OUT request would exceed

SCTP_MAX_CHUNK_LEN. Also tighten the local check so it does not send an

IN request that would require an oversized OUT request from the peer. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References