In the Linux kernel’s SCTP stack, the functions that validate ADD_IP, DEL_IP, and SET_PRIMARY parameters only check that the outer parameter is large enough for its header. They do not verify that the embedded address parameter’s declared length fits within the bounds of the enclosing parameter, allowing a malicious peer to advertise an address length that exceeds the remaining bytes. When the kernel processes the malformed packet, it reads beyond the bounds of the buffer, which can leak arbitrary kernel memory or cause a crash. The likely attack vector is a network-based SCTP packet sent by an attacker, this inference is drawn from the description that the flaw occurs during INIT or ASCONF processing of incoming SCTP traffic. The weakness is characterized as a classic out-of-bounds read (CWE-125) that could expose sensitive data.

The vulnerability affects the Linux kernel’s SCTP implementation. All Linux kernel builds that include SCTP support are potentially vulnerable unless patched, as the description does not list specific versions but applies to all unpatched releases that compile the SCTP modules.

The CVSS score of 9.1 indicates high severity, but the EPSS score of < 1% indicates that the observed exploitation probability is low; however, the flaw is publicly known and could be leveraged by an attacker who can reach the target over SCTP, which is generally accessible over the network. The impact includes potential data disclosure or denial of service, but not remote code execution. The vulnerability is not listed in the CISA KEV catalog, yet it warrants attentive monitoring, especially in environments that accept SCTP traffic from untrusted sources.