CVE-2026-68320

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix authchunklist capacity check in sctpauthepaddchunkid

sctpauthepaddchunkid() uses SCTPNUMCHUNKTYPES (20) as the capacity limit for ep->authchunklist, allowing it to hold up to 20 chunk entries (paramhdr.length up to 24). However, the copy destination asoc->c.authchunks in struct sctpcookie is only SCTPAUTHMAXCHUNKS (16) entries (20 bytes). When more than 16 chunks are added, sctpassociation_init() memcpy overflows the destination by up to 4 bytes.

Fix by using SCTPAUTHMAX_CHUNKS as the capacity limit, matching the destination capacity.