The vulnerability manifests when the Linux kernel’s SCTP stack processes an incoming RESET_IN_REQUEST. The sctp_process_strreset_inreq() function extracts the stream count from the packet length but fails to verify that the resulting outbound RESET_OUT_REQUEST will fit within SCTP_MAX_CHUNK_LEN. Because the outbound header is 8 bytes larger than the inbound one, a crafted stream list that fits within the incoming packet can trigger a 16‑bit overflow in sctp_make_strreset_req(). This overflow causes an undersized skb allocation, producing a kernel BUG that leads to a panic and a denial of service. The weakness corresponds to integer overflow (CWE‑190) and buffer overflow (CWE‑787).

All Linux kernels that include the SCTP protocol stack are affected. The flaw only manifests when SCTP is enabled and an incoming stream‑reset packet with a stream list that would generate an oversized outbound request is processed. Because the outbound request size can exceed the maximum chunk length on interfaces whose MTU is larger than 65535 bytes (e.g., loopback with IPv6 jumbograms), any Linux system using such interfaces with SCTP enabled is susceptible. The vendor impact list from the CNA lists only the generic Linux kernel, so the issue applies universally across distributions that ship the upstream kernel with SCTP support.

With a CVSS score of 7.5 the vulnerability is rated high severity. The EPSS score is reported as less than 1 %, indicating that successful exploitation is unlikely to be widespread. The flaw is not yet catalogued in the CISA KEV list. Based on the description, it is inferred that an attacker can trigger the crash by transmitting a malformed SCTP packet containing a RESET_IN_REQUEST over the network to a target that accepts SCTP connections; no authentication or special privileges are required. The attack requires an interface that can carry packets larger than 65535 bytes, such as a loopback link configured for IPv6 jumbograms.