CVE-2026-80717: Linux Kernel SCTP Information Disclosure

CVE-2026-80717 Overview

CVE-2026-80717 is an information disclosure vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw exists in the handling of the Adaptation Layer Indication parameter within INIT chunks. The sctp_verify_param() function accepts a header-only parameter because the generic parameter walker only requires the header to be present. When sctp_process_param() later reads the adaptation_ind field, it accesses memory beyond the declared parameter boundary. If the malformed parameter is placed last in an INIT chunk, the out-of-bounds read reaches the receive socket buffer (skb) tail. The leaked bytes are then copied into the state cookie returned in the INIT ACK, disclosing four receive-buffer tail bytes to a remote attacker.

Critical Impact
Remote unauthenticated attackers can trigger disclosure of up to four bytes of kernel receive-buffer tail memory per crafted INIT chunk, without any user interaction.

Affected Products

Linux kernel (SCTP subsystem)
Distributions shipping affected upstream stable kernel versions
Systems with the SCTP module loaded and reachable via network

Discovery Timeline

2026-08-28 - CVE-2026-80717 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80717

Vulnerability Analysis

The vulnerability resides in SCTP parameter processing during INIT chunk handling. The SCTP Adaptation Layer Indication parameter, defined in RFC 5061, contains a fixed 32-bit Adaptation Code Point that follows the standard 4-byte parameter header. The specification therefore mandates a total parameter length of eight bytes.

The kernel's parameter verification routine sctp_verify_param() relies on a generic parameter walker that validates only the presence of the parameter header. It does not enforce the type-specific fixed-length requirement for the Adaptation Indication parameter. A remote peer can send an INIT chunk containing an Adaptation Indication parameter whose declared length is only four bytes.

When sctp_process_param() subsequently reads the adaptation_ind field, it dereferences memory past the declared parameter boundary. Placing the truncated parameter last in the INIT chunk shifts the out-of-bounds read to the tail of the receive skb. The four bytes read from adjacent kernel memory are then embedded in the state cookie returned to the peer in the INIT ACK.

Root Cause

The root cause is missing type-specific length validation. The generic parameter walker enforces only the SCTP parameter header (type and length fields) but not the fixed size required by individual parameter types. This is an Out-of-Bounds Read caused by improper input validation of an attacker-controlled length field.

Attack Vector

An unauthenticated remote attacker sends a crafted SCTP INIT chunk to any listening SCTP endpoint. The INIT chunk contains a malformed Adaptation Indication parameter with a declared length of four bytes, positioned as the final parameter. The kernel accepts the parameter, reads beyond its boundary, and returns four bytes of adjacent receive-buffer memory to the attacker inside the state cookie of the INIT ACK response.

The vulnerability is described in prose because no verified public proof-of-concept code is available. Technical details of the corrective patches are available in the referenced kernel commits, including Kernel Commit 17b4124 and Kernel Commit fa7861d.

Detection Methods for CVE-2026-80717

Indicators of Compromise

Inbound SCTP INIT chunks containing an Adaptation Indication parameter with a declared length not equal to eight bytes.
Unusual volumes of SCTP INIT / INIT ACK exchanges from a single remote source targeting SCTP-enabled services.
Kernel log entries referencing invalid SCTP parameter length or aborted associations following INIT processing.

Detection Strategies

Deploy network intrusion detection signatures that parse SCTP INIT chunks and flag Adaptation Indication parameters whose declared length is less than eight bytes.
Monitor kernel versions across the fleet and identify hosts running kernels predating the fixes referenced in the upstream stable commits.
Correlate SCTP association abort events with source IP addresses to identify probing behavior consistent with information disclosure attempts.

Monitoring Recommendations

Enable SCTP protocol logging on hosts that expose SCTP services such as telecom signaling gateways, Diameter, or M3UA endpoints.
Baseline expected SCTP peers and alert on INIT chunks originating from unexpected networks.
Ingest kernel and network telemetry into a centralized analytics platform to correlate malformed SCTP traffic with downstream anomalies.

How to Mitigate CVE-2026-80717

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the CVE record to all affected systems.
Inventory hosts with the SCTP module (sctp.ko) loaded and prioritize patching for internet-reachable or partner-facing endpoints.
Restrict inbound SCTP traffic to known, trusted peers using host or perimeter firewalls until patches are deployed.

Patch Information

The upstream fix requires the declared Adaptation Indication parameter length to match its fixed structure size and aborts the association through the existing invalid-parameter-length path when the check fails. The corrective commits are available at Kernel Commit 17b4124, Kernel Commit 4c92c60, Kernel Commit 5fd7cfc, Kernel Commit 74b21f5, Kernel Commit 7b7e4e3, Kernel Commit 93942b5, Kernel Commit bfa28cf, and Kernel Commit fa7861d. Consume the fix through the stable kernel tree relevant to your distribution.

Workarounds

Blacklist the SCTP kernel module on systems that do not require SCTP by adding blacklist sctp to a file under /etc/modprobe.d/ and rebuilding the initramfs.
Use netfilter rules to drop inbound SCTP traffic from untrusted networks where the protocol must remain enabled.
Segment SCTP-dependent services (for example telecom signaling infrastructure) onto isolated networks with strict peer allowlists.

bash

# Configuration example
# Disable the SCTP module if not required
echo "install sctp /bin/true" | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo rmmod sctp 2>/dev/null || true

# Verify SCTP is no longer loadable
lsmod | grep sctp

# Optional: drop inbound SCTP traffic from untrusted sources (Linux nftables)
sudo nft add rule inet filter input meta l4proto sctp ip saddr != { 10.0.0.0/8 } drop