Executive brief
The Linux kernel's SCTP (Stream Control Transmission Protocol) implementation fails to validate the length of Adaptation Indication parameters in network packets. An attacker can send a malformed INIT packet with an invalid parameter to trigger an out-of-bounds read from the receive buffer. The leaked data is then included in the INIT ACK response, allowing disclosure of up to four bytes of sensitive kernel memory.
Technical details
The vulnerability is an out-of-bounds memory read in the SCTP protocol handler (net/sctp/sm_make_chunk.c). The sctp_verify_param() function accepts an Adaptation Layer Indication parameter with only the header present, but sctp_process_param() then reads a fixed 32-bit Adaptation Code Point beyond the declared parameter length. When the malformed parameter is the last in an INIT chunk, the read accesses the receive socket buffer tail, and the leaked value is copied into the state cookie in the INIT ACK. The fix adds length validation requiring the declared parameter length to match the fixed structure size (8 bytes for the full parameter including header and code point), aborting the association if validation fails. No authentication is required; the vulnerability is triggered via a malformed network packet.
Affected products
- Linux Linux kernel 2.6.12-rc2 and later (before patched versions)
Timeline
- 2026-08-28: disclosed
- 2026-08-09: patched: Fix published in stable kernel branches