SCTP_DIAG endpoint dumping in the Linux kernel traversed endpoint address lists without holding the socket lock, leading to a race condition. While the routine counted addresses under RCU protection, concurrent socket operations could modify the lists, causing fewer entries to be copied and potentially leaking uninitialized kernel memory to user space. This race condition results in information disclosure (CWE-824).

The vulnerability affects all Linux kernels derived from the mainline in which the SCTP diagnostics code is present, prior to the application of the fixes referenced in the advisory commit set. Distributions shipping these kernels before the patch are impacted, with no specific version limiting the scope beyond the presence of the diagnostic routine.

The CVSS score of 5.5 indicates moderate severity; however, the EPSS score of less than 1% and omission from the CISA KEV catalog suggest a low likelihood of current exploitation. The likely attack vector is via the SCTP netlink interface used for diagnostics, which probably requires privileged access; this assumption is inferred from the need to invoke dump operations. If an attacker can trigger the dump, the race can leak kernel data, exposing internal memory contents to the attacker, but no direct code execution or privilege escalation results. Thus, the risk is primarily information disclosure with low exploitation probability.