The Linux kernel’s SCTP implementation contains a use‑after‑free flaw where the sysctl variable net.sctp.auth_enable can be accessed after the control socket owning it has been released. An attacker opening or holding a reference to this sysctl file while the host’s network namespace is being torn down can force the kernel to dereference freed memory. The resulting memory corruption could allow privileged escalation or a kernel panic.

Any Linux kernel build that supports SCTP and exposes the net.sctp.auth_enable sysctl. No specific version range is given, so all kernels prior to the patch contain the vulnerability.

The likely attack vector involves a local process with privileges to open or manipulate sysctl entries targeting a namespace undergoing teardown. Based on the description, it is inferred that successful exploitation would require local root or elevated access to sysctl. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating limited known exploitation at present. However, the possibility of kernel memory corruption warrants prompt mitigation.