CVE-2026-80717

A moderate information disclosure flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation, affecting the Red Hat Enterprise Linux kernel and kernel-rt packages. The SCTP parameter verification code accepted an Adaptation Layer Indication parameter that contained only its parameter header, without the required fixed 32-bit Adaptation Code Point. A remote, unauthenticated attacker could send a specially crafted SCTP INIT message carrying such a malformed parameter, causing sctp_process_param() to read four bytes beyond the declared parameter length. When the malformed parameter is the last one in the INIT, the read starts at the receive socket-buffer tail and the value is copied into the state cookie returned in the INIT ACK, potentially disclosing up to four bytes of receive-buffer tail data to the attacker.

The kernel and kernel-rt packages in the affected Red Hat Enterprise Linux and Red Hat In-Vehicle Operating System streams are marked affected, with the fix deferred to a future kernel update; the residual risk until the fix is delivered is remote disclosure of this very small amount of receive-buffer tail data per crafted INIT/INIT ACK exchange. The Red Hat Enterprise Linux 6 Extended Lifecycle Support kernel is out of support and is not scheduled to receive a fix. Red Hat rates this flaw Moderate (CVSS 3.1 score of 5.5), lower than the CVE.org rating of Important (CVSS 3.1 score of 7.5), reflecting the limited amount of data (four receive-buffer tail bytes) that can be disclosed.