CVE-2026-68315

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sctp: validate stream count in sctp_process_strreset_inreq()<br /> <br /> When processing a RESET_IN_REQUEST from a peer,<br /> sctp_process_strreset_inreq() derives the stream count from the<br /> parameter length but does not check whether the resulting<br /> RESET_OUT_REQUEST would exceed SCTP_MAX_CHUNK_LEN.<br /> <br /> The OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes<br /> larger than the IN request header (sctp_strreset_inreq, 8 bytes).<br /> Generally, the IP payload is bounded to 65535 bytes, so the stream<br /> list cannot be large enough to trigger the overflow. However, on<br /> interfaces with MTU &gt; 65535 (e.g., loopback with IPv6 jumbograms), a<br /> stream list that fits within the incoming IN parameter can cause a<br /> __u16 overflow in sctp_make_strreset_req() when computing the OUT<br /> request size, leading to an undersized skb allocation and a kernel<br /> BUG:<br /> <br /> net/core/skbuff.c:207 skb_panic<br /> net/core/skbuff.c:2625 skb_put<br /> net/sctp/sm_make_chunk.c:1535 sctp_addto_chunk<br /> net/sctp/sm_make_chunk.c:3695 sctp_make_strreset_req<br /> net/sctp/stream.c:655 sctp_process_strreset_inreq<br /> <br /> The local setsockopt path validates the generated reset request size.<br /> However, for an incoming-only reset, it accounts for the smaller IN<br /> request even though the peer must generate an OUT request with the same<br /> stream list. Such a request cannot be completed successfully by the<br /> peer.<br /> <br /> Reject peer IN requests whose corresponding OUT request would exceed<br /> SCTP_MAX_CHUNK_LEN. Also tighten the local check so it does not send an<br /> IN request that would require an oversized OUT request from the peer.