In the SCTP handshake process, the INIT chunk is encapsulated within a cookie that the server returns to the client. When cookie authentication is disabled, the packet carrying this cookie is unwrapped without re‑validating the embedded INIT chunk. The original implementation treated the reconstructed chunk as trustworthy and forwarded it to the SCTP stack. This omission allows an attacker to tamper with the INIT parameters, potentially causing the kernel to allocate resources incorrectly, read or write outside allocated buffers, or accept forged association parameters. The vulnerability is a classic example of improper input validation leading to memory corruption and a denial‑of‑service or remote code execution surface.

All Linux kernel installations that run versions prior to the patch where SCTP cookie authentication can be disabled. The fix was applied in a recent kernel commit and includes the sctp_verify_init() checks added to the COOKIE‑ECHO path.

The CVSS score is 9.8, the EPSS score is below 1%, and it is not listed in the CISA KEV catalog. However, the attack vector is a network‑level one: an attacker who can initiate SCTP connections to a vulnerable host can craft a malformed INIT cookie and trigger the flaw. The potential impact ranges from service interruption to memory corruption that could be exploited for arbitrary code execution. Given the absence of publicly available exploits, the current risk is moderate but requires timely patching.