CVE-2026-68315

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate stream count in sctp_process_strreset_inreq()

When processing a RESET_IN_REQUEST from a peer,

sctp_process_strreset_inreq() derives the stream count from the

parameter length but does not check whether the resulting

RESET_OUT_REQUEST would exceed SCTP_MAX_CHUNK_LEN.

The OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes

larger than the IN request header (sctp_strreset_inreq, 8 bytes).

Generally, the IP payload is bounded to 65535 bytes, so the stream

list cannot be large enough to trigger the overflow. However, on

interfaces with MTU > 65535 (e.g., loopback with IPv6 jumbograms), a

stream list that fits within the incoming IN parameter can cause a

__u16 overflow in sctp_make_strreset_req() when computing the OUT

request size, leading to an undersized skb allocation and a kernel

BUG:

net/core/skbuff.c:207 skb_panic

net/core/skbuff.c:2625 skb_put

net/sctp/sm_make_chunk.c:1535 sctp_addto_chunk

net/sctp/sm_make_chunk.c:3695 sctp_make_strreset_req

net/sctp/stream.c:655 sctp_process_strreset_inreq

The local setsockopt path validates the generated reset request size.

However, for an incoming-only reset, it accounts for the smaller IN

request even though the peer must generate an OUT request with the same

stream list. Such a request cannot be completed successfully by the

peer.

Reject peer IN requests whose corresponding OUT request would exceed

SCTP_MAX_CHUNK_LEN. Also tighten the local check so it does not send an

IN request that would require an oversized OUT request from the peer.