In the Linux kernel's SCTP implementation, the function sctp_auth_ep_add_chunkid incorrectly sets the capacity of the authentication chunk list to the maximum number of chunk types (20). The destination cookie buffer, however, is only sized for 16 entries. When an attacker supplies more than 16 authentication chunks, a memcpy overwrites up to four bytes beyond the buffer, corrupting adjacent kernel memory. This boundary‑check failure results in a kernel‑space buffer overflow that can cause crashes or other unintended behavior.

All Linux distributions that ship the default kernel with SCTP support are affected. The vulnerability applies to any kernel that includes the SCTP module and predates the commit that fixed the capacity check. No specific version numbers are provided, so systems running the buggy code at any point are at risk when SCTP traffic is processed.

Based on the description, it is inferred that the vulnerability requires an SCTP connection that contains more than sixteen authentication chunks. The presented description does not indicate a privilege‑escalation outcome; the primary effect is kernel memory corruption, which could lead to a crash or a user‑space denial of service. Reliability metrics such as EPSS are missing, and the issue is not listed in KEV, so the exact exploitation frequency is unknown. Nonetheless, the potential impact of a kernel panic makes the risk high, and any machine that processes SCTP packets could be vulnerable.