CVE-2026-80717

What it actually does

Out-of-bounds read in SCTP parameter processing allows sctp_process_param() to copy four bytes from beyond the declared Adaptation Indication parameter (when header-only and last in INIT) into the state cookie returned in INIT ACK, disclosing receive-buffer tail bytes.

Why it matters to the business

Attackers can obtain small fragments of kernel receive buffer memory over the network, which may contain sensitive data such as portions of other packets or internal structures, increasing risk of information leakage on systems exposing SCTP.

How an attack unfolds

An attacker crafts an SCTP INIT chunk containing an Adaptation Indication parameter with only the header (no 32-bit Adaptation Code Point) placed last, sends it to a vulnerable listener; the kernel accepts the short parameter, performs an out-of-bounds read when populating the state cookie, and returns the leaked four bytes inside the INIT ACK.

How to fix it

Apply the upstream kernel patch that enforces exact parameter length matching for Adaptation Indication and aborts the association on mismatch; rebuild and deploy updated kernels across all SCTP-enabled systems.

How to confirm the fix worked

Confirm the fix by inspecting sctp_verify_param() source for the new length-equals-structure-size check, or run targeted SCTP fuzzing tools that send short Adaptation Indication parameters and verify the association is aborted without leaking data.

Typical attack path

1. Send SCTP INIT chunk with malformed Adaptation Indication parameter (length == header only) as the final parameter
2. Trigger sctp_verify_param() acceptance due to insufficient length check
3. Force sctp_process_param() to read adaptation_ind past the declared end into skb tail
4. Receive INIT ACK containing the leaked four bytes inside the state cookie

How to detect it

Inspect SCTP INIT packets for Adaptation Indication parameters whose declared length is smaller than the expected 32-bit code point size; correlate with subsequent INIT ACK responses that contain unexpected cookie contents, using packet captures or SCTP-aware network monitors.

What your security team should do

• Prioritize kernel updates on any hosts listening on SCTP ports
• Disable SCTP support via kernel config or module blacklist if the protocol is unused
• Monitor for unusual INIT traffic volumes on SCTP endpoints