Heimdall Security Logo

CVE-2026-68315

Vulnérabilité élevée dans Linux (Linux)

CVSS 7.5 · Élevée
EPSS 0.5%
Linux•Linux•Versions : <=6.1.*, <=6.12.*, 6.12.101, 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137, 4.11, 0, <=7.1.*, 5.15.216, <1a10fe1aa9c01f41b389a31906a77d538637c9d9, <=5.10.*, <=6.6.*, <61327d8e7cfb0259d527be17202630f556213249, <18ae07691d43183d270de8be9dc8e027906015d9, 6.18.42, <6f0e39d180cd7cced647381b6fa14fd83d261047, <60c47dea5d320d2fc706e9aad1db38a04df0a056, 7.1.6, 6.1.183, <00ae679cb21a035491fdad8d58dc6d79cc68b675, <4.11, <=6.18.*, <b255d8cd6cc68045ae9eecbac3b3c14e1f176c9b, <=*, <=5.15.*, 5.10.265, 6.6.148, 7.2, <7cf7439948e3bf639119119922c88ec190874ca3

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: validate stream count in sctp_process_strreset_inreq() When processing a RESET_IN_REQUEST from a peer, sctp_process_strreset_inreq() derives the stream count from the parameter length but does not check whether the resulting RESET_OUT_REQUEST would exceed SCTP_MAX_CHUNK_LEN. The OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes larger than the IN request header (sctp_strreset_inreq, 8 bytes). Generally, the IP payload is bounded to 65535 bytes, so the stream list cannot be large enough to trigger the overflow. However, on interfaces with MTU > 65535 (e.g., loopback with IPv6 jumbograms), a stream list that fits within the incoming IN parameter can cause a __u16 overflow in sctp_make_strreset_req() when computing the OUT request size, leading to an undersized skb allocation and a kernel BUG: net/core/skbuff.c:207 skb_panic net/core/skbuff.c:2625 skb_put net/sctp/sm_make_chunk.c:1535 sctp_addto_chunk net/sctp/sm_make_chunk.c:3695 sctp_make_strreset_req net/sctp/stream.c:655 sctp_process_strreset_inreq The local setsockopt path validates the generated reset request size. However, for an incoming-only reset, it accounts for the smaller IN request even though the peer must generate an OUT request with the same stream list. Such a request cannot be completed successfully by the peer. Reject peer IN requests whose corresponding OUT request would exceed SCTP_MAX_CHUNK_LEN. Also tighten the local check so it does not send an IN request that would require an oversized OUT request from the peer.

Gravité et risque d'exploitation

CVE-2026-68315 obtient un score CVSS de 7.5/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.51 %, ce qui la place devant 42.4 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions <=6.1.*, <=6.12.*, 6.12.101, 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137, 4.11, 0, <=7.1.*, 5.15.216, <1a10fe1aa9c01f41b389a31906a77d538637c9d9, <=5.10.*, <=6.6.*, <61327d8e7cfb0259d527be17202630f556213249, <18ae07691d43183d270de8be9dc8e027906015d9, 6.18.42, <6f0e39d180cd7cced647381b6fa14fd83d261047, <60c47dea5d320d2fc706e9aad1db38a04df0a056, 7.1.6, 6.1.183, <00ae679cb21a035491fdad8d58dc6d79cc68b675, <4.11, <=6.18.*, <b255d8cd6cc68045ae9eecbac3b3c14e1f176c9b, <=*, <=5.15.*, 5.10.265, 6.6.148, 7.2, <7cf7439948e3bf639119119922c88ec190874ca3) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE