CyberSecBulletin
CVE-2026-68300NVD status: Received

Linux: Improper Authentication

Published Updated By the CyberSecBulletin desk

CVE-2026-68300 is a critical-severity improper authentication vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions a129792b3aef15002746c13522781d92ed3522c3, 5a022ac51ad83b4ce6c898f4b9eefc65bd26b247, 6caf0e8590c0bf05a76b0d387726adf3a6f3725c as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.58% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to a129792b3aef15002746c13522781d92ed3522c3 or 5a022ac51ad83b4ce6c898f4b9eefc65bd26b247 or 6caf0e8590c0bf05a76b0d387726adf3a6f3725c or ec2e157fc9678a9bc411305a25aec3fd337d7efb, whichever matches your release line, or a later version.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxbbd0d59809f923ea2b540cbd781b32110e249f6e up to, but not including, a129792b3aef15002746c13522781d92ed3522c3; bbd0d59809f923ea2b540cbd781b32110e249f6e up to, but not including, 5a022ac51ad83b4ce6c898f4b9eefc65bd26b247; bbd0d59809f923ea2b540cbd781b32110e249f6e up to, but not including, 6caf0e8590c0bf05a76b0d387726adf3a6f3725c; bbd0d59809f923ea2b540cbd781b32110e249f6e up to, but not including, ec2e157fc9678a9bc411305a25aec3fd337d7efb; bbd0d59809f923ea2b540cbd781b32110e249f6e up to, but not including, 28c5fdce9dd955d2baf5e28987819b6d7cfaf646; bbd0d59809f923ea2b540cbd781b32110e249f6e up to, but not including, 18957373920caf5cdaf5cf32e5d1d7a99ca7700a; bbd0d59809f923ea2b540cbd781b32110e249f6e up to, but not including, 83f5031f2a6a49d696eb4cc0898345d12f9c6451; bbd0d59809f923ea2b540cbd781b32110e249f6e up to, but not including, 8e04823c120b376ef7dab14b60ebf6823aa16c14; and 1 more rangesa129792b3aef15002746c13522781d92ed3522c3, 5a022ac51ad83b4ce6c898f4b9eefc65bd26b247, 6caf0e8590c0bf05a76b0d387726adf3a6f3725c, ec2e157fc9678a9bc411305a25aec3fd337d7efb, 28c5fdce9dd955d2baf5e28987819b6d7cfaf646, 18957373920caf5cdaf5cf32e5d1d7a99ca7700a

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: sctp: auth: verify auth requirement when auth_chunk is NULL sctp_auth_chunk_verify() returns true unconditionally when chunk->auth_chunk is NULL, silently skipping authentication. This is incorrect when: 1. skb_clone() failed in the BH receive path, leaving auth_chunk NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new connections, so the early sctp_auth_recv_cid() check cannot catch this. 2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never called and auth_chunk remains NULL. Fix by checking sctp_auth_recv_cid() when auth_chunk is NULL: if authentication is required, return false to drop the chunk; otherwise continue normally.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

How developers prevent this class of flaw

  • Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

More Improper Authentication vulnerabilities (CWE-287)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Authentication vulnerabilities

Spotted an error? Tell us.