The vulnerability is a race condition in the Linux kernel’s SCTP implementation. It arises when sctp_wait_for_connect() releases the socket lock while waiting for an association to become established, and then reacquires it. During that window another thread can invoke SCTP_SOCKOPT_PEELOFF, moving the association to a new socket and changing asoc->base.sk. When the lock is re‑acquired, the routine mistakenly operates on the old socket, leading to access under a stale lock. This synchronization issue can result in memory corruption or kernel crashes, and it corresponds to CWE‑367.

The flaw affects all Linux kernel versions that include the pre‑patch SCTP code; no specific version range is given, so every kernel build that still contains the vulnerable implementation is potentially affected.

The CVSS score of 7.8 classifies the issue as high severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring a user or process that can create SCTP sockets and issue the peeloff option; these capabilities are normally available to any non‑privileged user on the system. While exploitation is unlikely, a successful attack could result in denial of service or kernel memory corruption.