CVE-2026-68315

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate stream count in sctp_process_strreset_inreq()

When processing a RESET_IN_REQUEST from a peer,

sctp_process_strreset_inreq() derives the stream count from the

parameter length but does not check whether the resulting

RESET_OUT_REQUEST would exceed SCTP_MAX_CHUNK_LEN.

The OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes

larger than the IN request header (sctp_strreset_inreq, 8 bytes).

Generally, the IP payload is bounded to 65535 bytes, so the stream

list cannot be large enough to trigger the overflow. However, on

interfaces with MTU > 65535 (e.g., loopback with IPv6 jumbograms), a

stream list that fits within the incoming IN parameter can cause a

__u16 overflow in sctp_make_strreset_req() when computing the OUT

request size, leading to an undersized skb allocation and a kernel

BUG:

net/core/skbuff.c:207 skb_panic

net/core/skbuff.c:2625 skb_put

net/sctp/sm_make_chunk.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References