A flaw in the Linux kernel’s SCTP implementation allows an attacker to supply a COOKIE_ECHO chunk containing an inflated INIT chunk length that is not validated against the actual payload size. The unchecked length causes the parameter walker to read beyond the received data, potentially corrupting memory during subsequent handling such as STATE_COOKIE processing. This out‑of‑bounds read can lead to information disclosure, crashes, or, if exploited further, arbitrary code execution.

The vulnerability exists in the Linux kernel. No specific affected versions are listed, so all kernel releases prior to the inclusion of the fix are potentially impacted. Users running standard Linux distributions should check whether their kernel contains the commit that adds a bounds check in sctp_unpack_cookie().

The vulnerability is remote; an attacker only needs to send a crafted SCTP packet to a listening SCTP server. While no CVSS score is supplied, the potential for memory corruption and the remote nature of the trigger imply a high risk of exploitation. The EPSS score is not available and the issue is not listed in CISA's KEV catalog at this time.