DEBIAN-CVE-2026-68300

In the Linux kernel, the following vulnerability has been resolved:  sctp: auth: verify auth requirement when authchunk is NULL  sctpauthchunkverify() returns true unconditionally when chunk->authchunk is NULL, silently skipping authentication. This is incorrect when:  1. skbclone() failed in the BH receive path, leaving authchunk    NULL. In sctpendpointbhrcv() asoc is NULL for new    connections, so the early sctpauthrecvcid() check cannot    catch this.  2. No AUTH chunk precedes COOKIE-ECHO, so skbclone() is never    called and authchunk remains NULL.  Fix by checking sctpauthrecvcid() when auth_chunk is NULL: if authentication is required, return false to drop the chunk; otherwise continue normally.