The Linux kernel’s SCTP subsystem contains a use‑after‑free flaw in the handling of the net.sctp.auth_enable sysctl. The flaw arises during network‑namespace teardown when the control socket has already been destroyed, but the sysctl still points to the freed structure. Accessing the sysctl can cause the kernel to dereference the stale pointer, potentially corrupting kernel memory or triggering a panic. The available information does not indicate a direct privilege escalation route; the flaw could potentially lead to kernel corruption and system crashes, which may be leveraged by a local attacker.

Any Linux kernel that supports SCTP and exposes the net.sctp.auth_enable sysctl is affected. Versions prior to the commit that moves sysctl registration into sctp_ctrlsock_init and registers/unregisters correctly are vulnerable. This includes all distributions whose kernels have not yet incorporated those changes.

The CVSS score of 7.8 indicates high severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would likely require a local user able to read or write the sysctl entry while a network namespace is being torn down. The primary risk is kernel memory corruption or denial of service, with no confirmed privilege escalation path documented.