CVE-2026-80717: sctp: validate Adaptation Indication parameter length
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate Adaptation Indication parameter length
The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its parameter header. However, sctpverifyparam() accepts a header-only parameter because the generic parameter walker only requires the header to be present.
sctpprocessparam() then reads adaptationind beyond the declared parameter. When the malformed parameter is last in an INIT, the read starts at the receive skb tail, and the value is copied into the state cookie returned in the INIT ACK. This may disclose four receive-buffer tail bytes.
Require the declared parameter length to match the fixed structure size and abort the association through the existing invalid parameter length path otherwise.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger the disclosure?
An attacker must be able to send a malformed SCTP INIT containing an Adaptation Layer Indication parameter that declares only a parameter header. The disclosure occurs when that malformed parameter is the final parameter in the INIT.
What information can be exposed?
The malformed parameter can cause the kernel to read beyond the declared parameter and copy four bytes from the receive-buffer tail into the state cookie returned in the INIT ACK.
How does the fix handle malformed Adaptation Layer Indication parameters?
The fix requires the parameter's declared length to exactly match the fixed structure size. Parameters with an invalid length cause the association to be aborted through the existing invalid-parameter-length path.