sctp_free_addr_wq() removed its timer using timer_delete() while holding the address workqueue lock. Because timer_delete() does not guarantee that a timer handler finished, another thread running sctp_addr_wq_timeout_handler() could still execute after the workqueue has been freed, acquire the lock and dereference freed memory. This race creates a use‑after‑free that an attacker could exploit to execute arbitrary code with kernel privileges, potentially raising to full system control.

All Linux kernel builds that ship the SCTP module and have not yet incorporated the patch will be affected. No specific version range was published, so the safest assumption is that every kernel incorporating the stable SCTP code before the commit that introduced timer_shutdown_sync() is vulnerable. The fix appears in the kernel repository at commits referenced in the advisory links.

The CVSS score is 7.8, indicating high severity, but the EPSS metric remains low at <1%. The vulnerability permits a use‑after‑free that could allow local privilege escalation if an attacker can trigger the race condition. Based on the description, it is inferred that an attacker might attempt to trigger the race by sending crafted SCTP packets, but the attack vector is not explicitly confirmed in the advisory. No public exploit has been reported, and the vulnerability is not listed in the CISA KEV catalog. Thus the likelihood of real‑world exploitation is uncertain, but the potential impact is significant.