The vulnerability arises in the Linux kernel’s SCTP implementation when processing a RESET_IN_REQUEST from a peer. The routine sctp_process_strreset_inreq() derives the number of streams from the incoming message length, but it does not verify that the resulting outbound RESET_OUT_REQUEST will fit within the maximum chunk length. Because the outbound header is 16 bytes versus the inbound header’s 8 bytes, a specially crafted stream list can cause a __u16 overflow in sctp_make_strreset_req(), leading to an undersized socket buffer allocation and a kernel BUG. This can result in a kernel panic and an unavailability of the affected system.

All Linux kernel instances that include the SCTP stack are affected. The flaw is triggered only when SCTP is enabled and an incoming stream reset packet with a stream list that fits within the inbound parameter but would require an oversized outbound packet is processed. In practice this can occur on interfaces with MTU greater than 65535 bytes, such as loopback IPv6 jumbograms, or any other interface that supports large packet sizes.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests that exploit attempts are expected to be rare. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the flaw by sending a malformed SCTP packet containing a RESET_IN_REQUEST to a target that accepts SCTP connections; no authentication is required, and the attack can be performed over the network if SCTP traffic is allowed.