{"cve":"CVE-2026-80717","nvd":{"published":"2026-08-28T08:16:57.430","modified":"2026-10-16T20:18:08.423","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate Adaptation Indication parameter length\n\nThe Adaptation Layer Indication parameter contains a fixed 32-bit\nAdaptation Code Point after its parameter header. However,\nsctp_verify_param() accepts a header-only parameter because the generic\nparameter walker only requires the header to be present.\n\nsctp_process_param() then reads adaptation_ind beyond the declared\nparameter. When the malformed parameter is last in an INIT, the read\nstarts at the receive skb tail, and the value is copied into the state\ncookie returned in the INIT ACK. This may disclose four receive-buffer\ntail bytes.\n\nRequire the declared parameter length to match the fixed structure size\nand abort the association through the existing invalid parameter length\npath otherwise.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":[],"references":["https://git.kernel.org/stable/c/17b412468c7a44f66a385bda48cdc1e94e39bd6d","https://git.kernel.org/stable/c/4c92c601c061e5602db2edeea54fef74aa304027","https://git.kernel.org/stable/c/5fd7cfc708dfc988ae9920c21075e6121bc89926","https://git.kernel.org/stable/c/74b21f52c5c5a71a05c0ff70e513f4f04ff28b17","https://git.kernel.org/stable/c/7b7e4e3640d57bd8857f0052c8b0d8ed4e5e954a"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:50:50.842544443+00:00"},"epss":{"cve":"CVE-2026-80717","score":0.00329,"percentile":0.25814,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}