A stale SCTP association can be dereferenced during the exact socket diagnostic lookup after the association has already been freed. The dereference occurs in the function that formats diagnostic messages, which may interpret an empty bind‑address list as a valid socket address entry. This results in an out‑of‑bounds read of memory that does not belong to the current association, potentially exposing kernel memory contents. The flaw is a classic use‑after‑free issue that can lead to unintended data leakage.

All Linux kernel builds that include the buggy SCTP diagnostic code before the applied patch are affected. The commit that introduced the fix is identified by 480f754580b…; any kernel released prior to that revision should be considered vulnerable. Administrators must verify the running kernel version against the commit to determine exposure.

The likely attack vector is the execution of an SCTP diagnostic request (e.g., via a netlink or ioctl interface) by a user with sufficient privileges to access the kernel’s diagnostic subsystem. Because the vulnerable path is only exercised during exact socket lookups, an attacker requires controlled SCTP traffic or specific diagnostic commands. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. While no public exploit has been reported and the vector is limited to privileged users or local system compromise, the resulting information disclosure could aid further attacks. Applying the kernel patch removes the vulnerability entirely.