CVE-2026-80717

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could exploit this by sending a specially crafted SCTP INIT message containing a malformed Adaptation Layer Indication parameter. The vulnerability causes the kernel to read beyond the declared parameter length, potentially disclosing four bytes from the receive buffer. This could lead to information disclosure.

A moderate information disclosure flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation, affecting the Red Hat Enterprise Linux kernel and kernel-rt packages. The SCTP parameter verification code accepted an Adaptation Layer Indication parameter that contained only its parameter header, without the required fixed 32-bit Adaptation Code Point. A remote, unauthenticated attacker could send a specially crafted SCTP INIT message carrying such a malformed parameter, causing sctp_process_param() to read four bytes beyond the declared parameter length. When the malformed parameter is the last one in the INIT, the read starts at the receive socket-buffer tail and the value is copied into the state cookie returned in the INIT ACK, potentially disclosing up to four bytes of receive-buffer tail data to the attacker.

The kernel and kernel-rt packages in the affected Red Hat Enterprise Linux and Red Hat In-Vehicle Operating System streams are marked affected, with the fix deferred to a future kernel update; the residual risk until the fix is delivered is remote disclosure of this very small amount of receive-buffer tail data per crafted INIT/INIT ACK exchange. The Red Hat Enterprise Linux 6 Extended Lifecycle Support kernel is out of support and is not scheduled to receive a fix. Red Hat rates this flaw Moderate (CVSS 3.1 score of 5.5), lower than the CVE.org rating of Important (CVSS 3.1 score of 7.5), reflecting the limited amount of data (four receive-buffer tail bytes) that can be disclosed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.