The flaw lies in the SCTP implementation of the Linux kernel. During the processing of an ASCONF (address configuration) chunk, the transport used to validate the chunk is cached. If a malicious ASCONF includes a DEL‑IP operation targeting a different address, the cached transport pointer can be freed while still in use. Subsequent wildcard DEL‑IP operations then dereference this freed pointer, corrupting the association’s primary path and causing the kernel to dereference invalid memory. The result is a kernel panic that effectively denies service to the affected node. The vulnerability is a classic use‑after‑free and results in a denial of service; no elevation of privilege is documented.

All Linux kernel implementations are affected, regardless of vendor. The exact kernel versions are not enumerated in the advisory, but the fix is included in recent upstream releases following commits referenced in the advisory links. Any system running an unpatched kernel that receives SCTP traffic is potentially susceptible.

The CVSS score is not provided, and no EPSS data is available, so the exact likelihood of exploitation is unknown. The flaw is accessible via crafted SCTP packets, thus a remote network attacker can trigger it by sending a specially crafted ASCONF sequence to the target host. Because it leads to a kernel crash, the impact is high. The vulnerability is not currently listed in the CISA KEV catalog, but its nature warrants immediate attention once a patch is applied.