{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80717","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-26T14:34:25.788Z","datePublished":"2026-08-28T06:53:14.886Z","dateUpdated":"2026-08-29T06:22:33.315Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-29T06:22:33.315Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate Adaptation Indication parameter length\n\nThe Adaptation Layer Indication parameter contains a fixed 32-bit\nAdaptation Code Point after its parameter header. However,\nsctp_verify_param() accepts a header-only parameter because the generic\nparameter walker only requires the header to be present.\n\nsctp_process_param() then reads adaptation_ind beyond the declared\nparameter. When the malformed parameter is last in an INIT, the read\nstarts at the receive skb tail, and the value is copied into the state\ncookie returned in the INIT ACK. This may disclose four receive-buffer\ntail bytes.\n\nRequire the declared parameter length to match the fixed structure size\nand abort the association through the existing invalid parameter length\npath otherwise."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is reached when a remote peer sends a crafted SCTP INIT to a listening endpoint; packets enter sctp_rcv() and sctp_sf_do_5_1B_init(), which calls sctp_verify_init() and sctp_process_init() before any association authentication.\nAC:L - Exploitation is deterministic SCTP packet crafting: place SCTP_PARAM_ADAPTATION_LAYER_IND last in INIT with a 4-byte header-only length so sctp_process_param() reads past the TLV into skb tail memory; no race, memory-layout lottery, or rare victim state is required beyond SCTP being enabled.\nPR:N - INIT processing is pre-authentication SCTP handshake handling on a listening server; the attacker needs only network reachability to the SCTP port and no local account, Linux capabilities, or init-namespace privileges on the target host.\nUI:N - No victim user action such as opening files or clicking links is required; exploitation needs only that an SCTP listener is reachable and automatically processes inbound INIT chunks during normal server operation.\nS:U - Impact is a bounded kernel skb out-of-bounds read whose contents are returned to the remote peer in the INIT-ACK state cookie; it does not cross VM, container, or IOMMU security boundaries.\nC:H - sctp_process_param() performs an out-of-bounds read of four kernel receive-buffer tail bytes when adaptation_ind is accessed beyond a header-only parameter; those bytes are copied into the state cookie and disclosed to the attacker in INIT-ACK.\nI:N - The defect is an out-of-bounds read only; no kernel memory is written, no association structures are corrupted, and the fix does not address any write primitive or control-flow hijacking.\nA:N - The out-of-bounds read copies four skb tail bytes into the association cookie and INIT-ACK without dereferencing unmapped memory; the commit describes information disclosure only and no kernel oops, panic, or hang."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sctp/sm_make_chunk.c"],"versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"fa7861ddbe3b525b5d541c15c3953d3569e6eb0e","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4c92c601c061e5602db2edeea54fef74aa304027","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7b7e4e3640d57bd8857f0052c8b0d8ed4e5e954a","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"93942b5772e0eee4147d4799cc1b936ae12fa615","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5fd7cfc708dfc988ae9920c21075e6121bc89926","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"17b412468c7a44f66a385bda48cdc1e94e39bd6d","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"bfa28cf99eb4d096c87da939f54233444d209ca5","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"74b21f52c5c5a71a05c0ff70e513f4f04ff28b17","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sctp/sm_make_chunk.c"],"versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","status":"unaffected","versionType":"semver"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.10.265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.6.151"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.12.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.18.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.1.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/fa7861ddbe3b525b5d541c15c3953d3569e6eb0e"},{"url":"https://git.kernel.org/stable/c/4c92c601c061e5602db2edeea54fef74aa304027"},{"url":"https://git.kernel.org/stable/c/7b7e4e3640d57bd8857f0052c8b0d8ed4e5e954a"},{"url":"https://git.kernel.org/stable/c/93942b5772e0eee4147d4799cc1b936ae12fa615"},{"url":"https://git.kernel.org/stable/c/5fd7cfc708dfc988ae9920c21075e6121bc89926"},{"url":"https://git.kernel.org/stable/c/17b412468c7a44f66a385bda48cdc1e94e39bd6d"},{"url":"https://git.kernel.org/stable/c/bfa28cf99eb4d096c87da939f54233444d209ca5"},{"url":"https://git.kernel.org/stable/c/74b21f52c5c5a71a05c0ff70e513f4f04ff28b17"}],"title":"sctp: validate Adaptation Indication parameter length","x_generator":{"engine":"bippy-1.2.0"}}}}