VulnSocial

CVE-2026-68376Patch

HIGHCVSS 8.1 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_hmacs array size in struct sctp_cookie The auth_hmacs array in struct sctp_cookie is supposed to store a complete SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr followed by N HMAC identifiers. However, the array size was calculated using an extra 2 bytes instead of sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers are configured, the HMAC-ALGO parameter stored in the endpoint is larger than the auth_hmacs buffer in the cookie. As a result, sctp_association_init() copies beyond the end of auth_hmacs when initializing the association, corrupting the adjacent auth_chunks field. This can lead to an invalid HMAC identifier being accepted and later cause an out-of-bounds read in sctp_auth_get_hmac(). Fix the array size calculation by including the full SCTP parameter header size.

Back to dashboard
7.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-787

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 4 mentions across 4 observed days

What's happening

  • Active exploitation reported across 1 signal
  • Exploit tool or code specified in 3 signals
  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Peaked 3d ago at 1 mentions (2026-09-08); latest day: 1
  • 4 total mentions across 4 days

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-09-08: 1Mentions · 2026-09-10: 1Mentions · 2026-09-12: 1Mentions · 2026-09-15: 1PoC Mentioned / Linked · 2026-09-10: 1PoC Mentioned / Linked · 2026-09-12: 1Exploit Tool / Code · 2026-09-10: 1Exploit Tool / Code · 2026-09-12: 1Exploit Tool / Code · 2026-09-15: 1Active Exploitation · 2026-09-12: 1Patch / Workaround · 2026-09-08: 1Patch / Workaround · 2026-09-15: 1Technical Details · 2026-09-10: 1Technical Details · 2026-09-15: 109-0809-1009-1209-15
Signal classification4 categories
Patch
125.0%
PoC
125.0%
Active Exploitation
125.0%
Exploit
125.0%
Referenced assets12 URLs
Classification over time
DateTotalLabels
2026-09-081
Patch1
2026-09-101
PoC1
2026-09-121
Active Exploitation1
2026-09-151
Exploit1
Full discourse4 posts
  • Mr. OS@ksg93rd
    Active Exploitation

    #Analytics #Threat_Research An analytical review of the main cybersecurity events (Sep 05-12, 2026) 1⃣ Sonicwall SMA1000 Attack https://hunt.io/blog/sonicwall-sma1000-uk-council-attack // CVE-2026-15409 2⃣ Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://hunt.io/blog/sonicwall-sma1000-uk-council-attack 3⃣ Next Nightmare Eclipse Vulnerability https://github.com/MSNightmare/ShieldCrash/blob/main/README.md // Microsoft has failed to properly patch ShieldBreak CVE-2026-69414.. 4⃣ FortiPAM Vulnerability https://amibeingpwned.com/blog/fortinet-pam-vuln // CVE-2026-84388 5⃣ Researchers from Nebula Security have disclosed 18 vulnerabilities in the Linux kernel https://www.openwall.com/lists/oss-security/2026/09/08/1 // CVE-2026-80714, CVE-2026-74597, CVE-2026-74581, CVE-2026-74480, CVE-2026-72255, CVE-2026-72137, CVE-2026-68376, CVE-2026-68162, CVE-2026-64560,  CVE-2026-63834, CVE-2026-52933, CVE-2026-52929, CVE-2026-52924, CVE-2026-52923, CVE-2026-52912, CVE-2026-43501, CVE-2026-43502, CVE-2026-43074, CVE-2026-43042, CVE-2026-31678, CVE-2026-31659, CVE-2026-23274 6⃣ Netscaler ADC Exploit 7⃣ Critical vulnerabilities in MikroTik RouterOS https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ 8⃣ GRAYRABBIT One-click backdoor // One click. Three critical failures. One backdoor https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou 9⃣ Attacks using browser-in-browser (BiTB) phishing techniques https://www.huntress.com/blog/phishing-bitb-rmm-attacks 🔟 Beltdown: Escaping the Claude Code sandbox https://www.accomplish.ai/blog/beltdown-escaping-the-claude-code-sandbox/ // An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user http://www.Geniebot.pro http://www.cyberpocket.org

    Post summary

    The post catalogues multiple CVEs, highlighting some active exploitation and referencing PoC links, but offers limited technical detail or mitigation information.

    01052601
    3.4K followersView on X
  • OS開発者@hacker_infra
    Patch

    https://github.com/NebuSec/CyberMeowfia/tree/main/security-research CVE4つも公開されているがな。エクスプロイト 1 CVE-2026-31659 緩和策 echo "install batman-adv /bin/true" > /etc/modprobe.d/disable-batman-adv.conf 2 cve-2026-74597 緩和策 grubby --update-kernel=ALL --args="ipv6.disable=1" reboot 3 CVE-2026-68376 緩和策 echo "install sctp /bin/true" > /etc/modprobe.d/disable-sctp.conf 4 CVE-2026-63834 echo "install batman-adv /bin/true" > /etc/modprobe.d/disable-batman-adv.conf

    Post summary

    The announcement enumerates four CVEs and supplies corresponding mitigation steps but provides no evidence of PoC, exploit code, or active exploitation.

    00071469
    2.9K followersView on X
  • Rıdvan Yağlı@ridvanyagli
    PoC

    🔴 CVE-2026-68376: Linux kernel'in SCTP bileşeninde bulunan memory corruption açığı için, NebuSec tarafından Ubuntu 7.0.0-30 kernel'i üzerinde test edilmiş public PoC yayınlandı. CVSS: 8.1 (HIGH). https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-68376-Ubuntu-7.0.0-30

    Post summary

    CVE‑2026‑68376, a memory‑corruption flaw in Linux SMP SCTP, has a publicly available PoC on GitHub; no evidence of active exploitation or patches is mentioned.

    00060802
    2.4K followersView on X
  • Threat Landscape@LandscapeThreat
    Exploit

    Researchers disclosed CVE-2026-43502, a Linux kernel local privilege-escalation vulnerability in the RDS zerocopy send path, alongside 20 additional exploitable Linux bugs. - An unprivileged local user can obtain root privileges without Linux capabilities or user namespaces when required networking, asynchronous I/O, and RDS components are enabled. - The vulnerability affects kernels from Linux v4.17 and was demonstrated on openSUSE with kernel 6.4.0-150600.23.100. - The issue was fixed by commit 44b550d88b26, first included in Linux v7.1-rc3; public exploits for the listed vulnerabilities are available. VULNERABILITY CVE-2026-23274 CVE-2026-31659 CVE-2026-31678 CVE-2026-43042 CVE-2026-43074 CVE-2026-43501 CVE-2026-43502 CVE-2026-52912 CVE-2026-52923 CVE-2026-52924 CVE-2026-52929 CVE-2026-52933 CVE-2026-63834 CVE-2026-64560 CVE-2026-68162 CVE-2026-68376 CVE-2026-72137 CVE-2026-72255 CVE-2026-74480 CVE-2026-74581 CVE-2026-74597 CVE-2026-80714

    Post summary

    The text discloses CVE-2026-43502 (Linux kernel privilege escalation) alongside 20 CVEs, explicitly stating public exploits are available and identifying a fixed kernel version (v7.1-rc3), with moderate technical details.

    0002055
    123 followersView on X

Explore more

Back to dashboard