A malformed SCTP ERROR chunk containing a STALE_COOKIE cause can trigger an out‑of‑bounds read of the staleness field. Because the kernel does not validate the length of the STALE_COOKIE cause, the read accesses uninitialized memory and the value is reflected back to the peer in the Cookie Preservative of a reply INIT. The failure is an unchecked read that leads to leakage of potentially sensitive kernel memory contents.

The flaw is in the Linux kernel’s SCTP implementation. All kernel releases that contain the unpatched SCTP module are vulnerable, regardless of vendor, including any distribution that employs the upstream Linux kernel.

The flaw can be triggered by any local process that can drive an SCTP association into the COOKIE_ECHOED state, such as a user who opens a raw SCTP socket in its own network namespace and sends crafted packets. Because the attacker only needs to send malformed SCTP ERROR chunks, the attack vector is local to that process, and does not require remote host intervention. The CVSS score of 9.1 classifies the vulnerability as Critical. The EPSS score of <1% indicates a very low but non‑zero exploitation probability, and because the vulnerability is not yet listed in KEV, no widespread exploitation is known. Nonetheless, the high severity and ease of local exploitation via a raw SCTP socket mean the risk remains moderate to high, warranting immediate patch.