CVE-2026-68376

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. An incorrect array size calculation for the auth_hmacs field within the sctp_cookie structure could lead to a buffer overflow. During the initialization of an SCTP association, if four HMAC identifiers are configured, the system attempts to copy data beyond the allocated buffer. This results in the corruption of an adjacent memory field (auth_chunks) and can subsequently cause an out-of-bounds read when processing HMAC identifiers.

This vulnerability is rated as Important because an attacker can trigger kernel memory corruption during association setup, leading to system crashes or kernel memory disclosure. In Red Hat Enterprise Linux, the sctp kernel module is not loaded by default unless an application explicitly opens an SCTP socket. Exploitation is constrained by the prerequisite that an endpoint must be configured with multiple HMAC authentication algorithms, which is uncommon in default network deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent the SCTP kernel module from loading, blacklist it by creating a file /etc/modprobe.d/disable-sctp.conf with the content blacklist sctp. Regenerate the initramfs using dracut -f -v (RHEL 8/9/10) or mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r) (RHEL 7), then reboot the system. This action may affect applications dependent on SCTP.