CVE-2026-80717

Received Received - Intake

SCTP Adaptation Indication Parameter Length Validation Flaw

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: validate Adaptation Indication parameter length The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its parameter header. However, sctp_verify_param() accepts a header-only parameter because the generic parameter walker only requires the header to be present. sctp_process_param() then reads adaptation_ind beyond the declared parameter. When the malformed parameter is last in an INIT, the read starts at the receive skb tail, and the value is copied into the state cookie returned in the INIT ACK. This may disclose four receive-buffer tail bytes. Require the declared parameter length to match the fixed structure size and abort the association through the existing invalid parameter length path otherwise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80717

EUVD

EUVD-2026-67452

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of the Adaptation Indication parameter in SCTP (Stream Control Transmission Protocol). The issue occurs because the code accepts a malformed parameter with only a header, leading to reading beyond the declared parameter length. This can expose four bytes of receive-buffer memory when processing an INIT chunk.

Detection Guidance

This vulnerability involves SCTP protocol handling in the Linux kernel. Detection requires checking kernel versions and SCTP parameter handling. Monitor kernel logs for SCTP-related errors or crashes. Use commands like 'dmesg | grep sctp' or 'journalctl -k | grep sctp' to identify issues. Ensure your kernel is updated to a patched version.

Impact Analysis

An attacker could exploit this to leak sensitive memory contents from the kernel's receive buffer. This may expose confidential data, though the impact is limited to four bytes per malformed packet. The vulnerability requires network access to trigger.

Compliance Impact

This vulnerability may lead to information disclosure by exposing four receive-buffer tail bytes in the state cookie. This could potentially violate data protection requirements under GDPR (e.g., Article 32 on security of processing) or HIPAA (e.g., safeguards for protected health information) if sensitive data is exposed.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for this SCTP vulnerability. If updating is not immediately possible, disable the SCTP module using 'rmmod sctp' and blacklist it in '/etc/modprobe.d/'. Monitor vendor advisories for kernel patches and apply them promptly.

Hi! I’m here to help you understand CVE-2026-80717. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70