CVE-2026-80717

The Linux kernel's SCTP implementation does not validate the length of the Adaptation Layer Indication parameter in an INIT chunk: the generic parameter walker in sctp_verify_param() accepts a header-only parameter, and sctp_process_param() then reads the fixed 32-bit Adaptation Code Point beyond the declared parameter boundary. An unauthenticated remote attacker can trigger this by sending an SCTP INIT in which the truncated Adaptation Layer Indication parameter is the last parameter, causing the read to start at the receive skb tail and the garbage value to be copied into the state cookie returned in the INIT ACK. The attacker gains disclosure of up to four bytes of receive-buffer tail memory per crafted INIT (CVSS rates confidentiality impact high); there is no integrity or availability impact. Any Linux system with SCTP enabled and a network-reachable SCTP listener is affected. Exploitation is currently unknown: no public PoC, not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.3%.

What to do: Apply the upstream patch 'sctp: validate Adaptation Indication parameter length' via your distribution's kernel update once a fixed build is published, and check vendor advisories for the fixed version numbers. As interim mitigation, limit exposure of SCTP services by firewalling SCTP traffic from untrusted networks and confirm whether any SCTP listeners are running (e.g., via ss or /proc/net/sctp).