{"id":5442,"date":"2026-09-04T18:47:50","date_gmt":"2026-09-04T10:47:50","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-68376"},"modified":"2026-09-04T18:47:50","modified_gmt":"2026-09-04T10:47:50","slug":"cve-2026-68376","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-68376","title":{"rendered":"CVE-2026-68376 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix auth_hmacs"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>sctp: fix auth_hmacs array size in struct sctp_cookie<\/p>\n<p>The auth_hmacs array in struct sctp_cookie is supposed to store a complete<br \/>\nSCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr<br \/>\nfollowed by N HMAC identifiers.<\/p>\n<p>However, the array size was calculated using an extra 2 bytes instead of<br \/>\nsizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers<br \/>\nare configured, the HMAC-ALGO parameter stored in the endpoint is larger<br \/>\nthan the auth_hmacs buffer in the cookie.<\/p>\n<p>As a result, sctp_association_init() copies beyond the end of auth_hmacs<br \/>\nwhen initializing the association, corrupting the adjacent auth_chunks<br \/>\nfield. This can lead to an invalid HMAC identifier being accepted and later<br \/>\ncause an out-of-bounds read in sctp_auth_get_hmac().<\/p>\n<p>Fix the array size calculation by including the full SCTP parameter header<br \/>\nsize.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>sctp: fix auth_hmacs array size in struct sctp_cookie<\/p>\n<p>The auth_hmacs array in struct sctp_cookie is supposed to store a complete<br \/>\nS<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5442","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5442","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5442"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5442"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5442"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}