CVE-2026-80717 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate Adaptation Indication parameter length
The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its parameter header. However, sctp_verify_param() accepts a header-only parameter because the generic parameter walker only requires the header to be present.
sctp_process_param() then reads adaptation_ind beyond the declared parameter. When the malformed parameter is last in an INIT, the read starts at the receive skb tail, and the value is copied into the state cookie returned in the INIT ACK. This may disclose four receive-buffer tail bytes.
Require the declared parameter length to match the fixed structure size and abort the association through the existing invalid parameter length path otherwise.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel's Stream Control Transmission Protocol implementation contains a critical validation flaw within the SCTP initialization process, specifically concerning the handling of the Adaptation Indication parameter. This vulnerability stems from an insufficient boundary check in the generic parameter verification logic used by sctp_verify_param(). The protocol specification dictates that the Adaptation Layer Indication parameter must contain not only its standard header but also a fixed 32-bit Adaptation Code Point immediately following it. However, the existing validation routine accepts parameters where the declared length corresponds solely to the header size, ignoring the requirement for the subsequent data payload. This oversight allows malformed packets with truncated or improperly sized adaptation indication fields to pass initial verification stages without triggering an error condition that would normally reject invalid parameter lengths.
The operational impact of this flaw is significant because it leads to a heap-based out-of-bounds read during the processing phase. When sctp_process_param() encounters such a malformed Adaptation Indication parameter, it proceeds to read memory beyond the declared boundaries of the packet structure. In scenarios where this specific parameter appears as the final element within an INIT chunk, the buffer pointer advances past the end of the received socket buffer into adjacent kernel memory regions. The data retrieved from these unauthorized memory locations is then incorporated into the state cookie that is returned in the subsequent INIT ACK message to the peer endpoint. This mechanism effectively transforms a simple validation error into a sensitive information disclosure vulnerability, as arbitrary bytes from the receive buffer tail are leaked to external parties through standard protocol responses.
From a security architecture perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-125 Out-of-bounds Read. The failure lies in the assumption that header presence equates to structural validity without enforcing strict length constraints relative to expected data structures. In terms of attack vectors, this vulnerability can be exploited remotely by an attacker sending crafted SCTP INIT packets designed to trigger the out-of-bounds read condition. This activity is consistent with ATT&CK technique T1082 System Information Discovery, as it allows for the enumeration and exfiltration of internal kernel memory contents which may contain sensitive data such as stack canaries, pointers, or other process-specific information that could facilitate further exploitation attempts like return-oriented programming attacks.
To mitigate this vulnerability, the Linux kernel developers have implemented a strict length validation check within the parameter processing logic. The fix ensures that the declared length of the Adaptation Indication parameter exactly matches the expected fixed structure size, which includes both the header and the 32-bit adaptation code point. If the lengths do not match, the association process is aborted via the existing invalid parameter length error handling path rather than proceeding to read beyond buffer boundaries. System administrators should ensure that their systems are updated with kernel patches that include this specific SCTP validation fix. Additionally, deploying network intrusion detection systems capable of inspecting SCTP packet structures for anomalous parameter lengths can provide an additional layer of defense against exploitation attempts targeting this flaw before the underlying software is patched.