In the Linux kernel’s SCTP implementation, the sctp_sendmsg() routine walks a list of SCTP associations while holding a socket lock. Inside the loop, sctp_sendmsg_to_asoc() may drop the lock, allowing another thread to migrate or free the current association via SCTP_SOCKOPT_PEELOFF or a network ABORT. Because the iterator is not re‑validated after the lock is reacquired, the loop may continue to reference a stale or relocated list entry, leading to a use‑after‑free or type‑confusion that can be exploited locally to redirect execution to a controlled function pointer, potentially giving kernel‑level code execution.

All Linux kernel versions that include SCTP support (CONFIG_SCTP built‑in or loaded as a module) and have not yet applied the iterator‑validation patch are vulnerable. The advisory does not list specific version ranges, so any susceptible kernel is considered at risk until patched.

The flaw requires local access; an attacker must be able to open an SCTP socket and trigger the send path. The CVSS score of 7.0 indicates high severity, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. No public exploits are known, but the combination of a use‑after‑free and type‑confusion presents a strong potential for local privilege escalation if the attacker can exercise the vulnerable code path.