In the Linux kernel's SCTP implementation, the function sctp_auth_ep_add_chunkid incorrectly sets the capacity of the authentication chunk list to the maximum number of chunk types (20). The destination cookie buffer, however, is only sized for 16 entries. When an attacker supplies more than 16 authentication chunks, a memcpy overwrites up to four bytes beyond the buffer, corrupting adjacent kernel memory. This boundary‑check failure results in a kernel‑space buffer overflow that can cause crashes or other unintended behavior.

All Linux distributions that ship the default kernel with SCTP support are affected. The vulnerability applies to any kernel that includes the SCTP module and predates the commit that fixed the capacity check. No specific version numbers are provided, so systems running the buggy code at any point are at risk when SCTP traffic is processed.

The CVSS score of 7.3 indicates a high impact. The EPSS score of <1% shows that, at present, the probability of exploitation is very low, but the vulnerability is still active and not listed in KEV. Attackers would need to establish an SCTP connection with more than sixteen authentication chunks to trigger the memcpy overflow that corrupts four bytes of kernel memory. While the description does not detail a privilege escalation, corrupted kernel memory can lead to a crash or other unintended behavior, potentially causing a denial of service.