CVE-2026-68320

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. This vulnerability occurs because the sctp_auth_ep_add_chunkid function allows more data to be written than the allocated buffer can hold during the initialization of an SCTP association. A remote attacker could potentially exploit this buffer overflow to cause memory corruption, leading to a denial of service or other unpredictable system behavior.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access and specific configuration of SCTP chunk authentication on an active association to trigger memory corruption. Although the defect can cause a bounded out-of-bounds write in kernel memory that could lead to a system crash or denial of service, the SCTP module is not loaded by default or configured with chunk authentication on typical installations. Consequently, environments that do not actively deploy SCTP networking services are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.