CVE-2026-80717

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sctp: validate Adaptation Indication parameter length<br /> <br /> The Adaptation Layer Indication parameter contains a fixed 32-bit<br /> Adaptation Code Point after its parameter header. However,<br /> sctp_verify_param() accepts a header-only parameter because the generic<br /> parameter walker only requires the header to be present.<br /> <br /> sctp_process_param() then reads adaptation_ind beyond the declared<br /> parameter. When the malformed parameter is last in an INIT, the read<br /> starts at the receive skb tail, and the value is copied into the state<br /> cookie returned in the INIT ACK. This may disclose four receive-buffer<br /> tail bytes.<br /> <br /> Require the declared parameter length to match the fixed structure size<br /> and abort the association through the existing invalid parameter length<br /> path otherwise.