{
  "threat_severity" : "Moderate",
  "public_date" : "2026-08-10T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: sctp: auth: verify auth requirement when auth_chunk is NULL",
    "id" : "2513408",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2513408"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-303",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nsctp: auth: verify auth requirement when auth_chunk is NULL\nsctp_auth_chunk_verify() returns true unconditionally when\nchunk->auth_chunk is NULL, silently skipping authentication.\nThis is incorrect when:\n1. skb_clone() failed in the BH receive path, leaving auth_chunk\nNULL. In sctp_endpoint_bh_rcv() asoc is NULL for new\nconnections, so the early sctp_auth_recv_cid() check cannot\ncatch this.\n2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never\ncalled and auth_chunk remains NULL.\nFix by checking sctp_auth_recv_cid() when auth_chunk is NULL:\nif authentication is required, return false to drop the chunk;\notherwise continue normally.", "A flaw was found in the Stream Control Transmission Protocol (SCTP) authentication mechanism within the Linux kernel. The `sctp_auth_chunk_verify()` function incorrectly processes authentication chunks, leading to authentication requirements being silently bypassed. This can occur under specific conditions, such as when memory allocation fails or when an authentication chunk is missing before a COOKIE-ECHO message. An attacker could potentially exploit this to bypass intended security controls." ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-68300\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68300\nhttps://lore.kernel.org/linux-cve-announce/2026081029-CVE-2026-68300-ab03@gregkh/T" ],
  "name" : "CVE-2026-68300",
  "csaw" : false
}