CVE-2026-68315: sctp: validate stream count in sctp_process_strreset_inreq()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate stream count in sctp_process_strreset_inreq()

When processing a RESET_IN_REQUEST from a peer,
sctp_process_strreset_inreq() derives the stream count from the
parameter length but does not check whether the resulting
RESET_OUT_REQUEST would exceed SCTP_MAX_CHUNK_LEN.

The OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes
larger than the IN request header (sctp_strreset_inreq, 8 bytes).
Generally, the IP payload is bounded to 65535 bytes, so the stream
list cannot be large enough to trigger the overflow. However, on
interfaces with MTU > 65535 (e.g., loopback with IPv6 jumbograms), a
stream list that fits within the incoming IN parameter can cause a
__u16 overflow in sctp_make_strreset_req() when computing the OUT
request size, leading to an undersized skb allocation and a kernel
BUG:

  net/core/skbuff.c:207         skb_panic
  net/core/skbuff.c:2625        skb_put
  net/sctp/sm_make_chunk.c:1535 sctp_addto_chunk
  net/sctp/sm_make_chunk.c:3695 sctp_make_strreset_req
  net/sctp/stream.c:655         sctp_process_strreset_inreq

The local setsockopt path validates the generated reset request size.
However, for an incoming-only reset, it accounts for the smaller IN
request even though the peer must generate an OUT request with the same
stream list. Such a request cannot be completed successfully by the
peer.

Reject peer IN requests whose corresponding OUT request would exceed
SCTP_MAX_CHUNK_LEN. Also tighten the local check so it does not send an
IN request that would require an oversized OUT request from the peer.

The Linux kernel CVE team has assigned CVE-2026-68315 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.11 with commit 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 and fixed in 6.6.148 with commit b255d8cd6cc68045ae9eecbac3b3c14e1f176c9b
	Issue introduced in 4.11 with commit 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 and fixed in 6.12.101 with commit 6f0e39d180cd7cced647381b6fa14fd83d261047
	Issue introduced in 4.11 with commit 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 and fixed in 6.18.42 with commit 1a10fe1aa9c01f41b389a31906a77d538637c9d9
	Issue introduced in 4.11 with commit 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 and fixed in 7.1.6 with commit 00ae679cb21a035491fdad8d58dc6d79cc68b675
	Issue introduced in 4.11 with commit 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 and fixed in 7.2-rc5 with commit 18ae07691d43183d270de8be9dc8e027906015d9

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68315
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/sctp/stream.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b255d8cd6cc68045ae9eecbac3b3c14e1f176c9b
	https://git.kernel.org/stable/c/6f0e39d180cd7cced647381b6fa14fd83d261047
	https://git.kernel.org/stable/c/1a10fe1aa9c01f41b389a31906a77d538637c9d9
	https://git.kernel.org/stable/c/00ae679cb21a035491fdad8d58dc6d79cc68b675
	https://git.kernel.org/stable/c/18ae07691d43183d270de8be9dc8e027906015d9