The Linux kernel’s SCTP implementation contains a memory leak when unrecognized parameters appear in an INIT packet. The function sctp_verify_init() allocates an err_chunk to report the bad parameters, but that chunk is not freed along several error and success code paths. Over time, each leaked chunk consumes kernel memory, which can degrade performance or trigger out‑of‑memory conditions, resulting in a denial of service rather than direct code execution.

All Linux kernel builds that include SCTP support are susceptible, regardless of distribution or version, because the offending code resides in the core kernel source. Any system running an unpatched kernel with SCTP enabled may be impacted as long as the SCTP stack is compiled into the kernel.

The CVSS score of 5.5 denotes a moderate severity. The EPSS score of <1% indicates a low likelihood of exploitation in the wild at present, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is an attacker sending crafted SCTP INIT packets containing unrecognized parameters. It is inferred that repeated receipt of such packets can incrementally drain system memory; the attacker does not require authentication and can operate from any network location that can reach the target’s SCTP interface. Consequently, an attacker could drive the target toward a memory exhaustion state and cause a service disruption.