A miscalculation in the size of the auth_hmacs array in the struct sctp_cookie causes sctp_association_init() to copy more data than the buffer can hold. This corruption of adjacent auth_chunks memory can lead to an out-of-bounds read when sctp_auth_get_hmac() accesses the corrupted buffer. The vulnerability arises from a buffer size miscalculation and is categorised as a classic out‑of‑bounds write (CWE-787).

Any Linux kernel that implements the SCTP protocol and is built from source code before the commit correcting the auth_hmacs array size is affected. This includes all current mainstream distributions that have not yet applied the patch. The vulnerability is present in the kernel itself, irrespective of the specific distribution, as long as the flawed code is included.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests a low expected exploitation rate. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely to be remote: an adversary can send a specially crafted SCTP packet containing an oversized SCTP_AUTH_HMAC_ALGO parameter to a target system, triggering the flaw from the network without requiring local privileges. While the exploitation path is relatively straightforward, the low EPSS score indicates that widespread exploitation is currently unlikely.