The vulnerability exists in the Linux kernel's SCTP implementation. The __sctp_rcv_asconf_lookup() function checks only that an ASCONF chunk is large enough for the ADDIP header and a parameter header before calling af->from_addr_param(), which trusts the parameter’s declared length and reads a full 16‑byte IPv6 address. An unauthenticated SCTP peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4‑byte parameter header. When this path is taken, from_addr_param() reads up to 16 bytes from beyond the end of the supplied data, accessing uninitialised memory. This can lead to leakage of sensitive information stored in that region kernel panic, affecting confidentiality or availability. The weakness corresponds to CWE‑788. The bug is not tied to authentication or privilege, so any host receiving SCTP traffic from an external network could be affected.

The flaw resides in the Linux kernel’s SCTP stack. All kernel releases performing the affected code path are potentially vulnerable; no specific versions are listed in the advisory. System administrators should ensure that their kernel is at a revision containing the commit that applies this fix. SCTP support is optional on many systems, so disabling the protocol may also limit exposure.

The EPSS score is not available, and there is no KEV listing. The patch is included in the kernel source repository; applying the update removes the boundary check omission and secures the receive path.