The flaw resides in the SCTP implementation of the Linux kernel. When an association adds the 65,536th transport, the 16‑bit transport_count field wraps to zero. A diagnostic request (sock_diag) then reserves a payload based on the wrapped count and copies more peer addresses than the buffer can hold, writing past the end of the skb buffer. This out‑of‑bounds write can corrupt kernel memory, potentially causing a system crash or allowing an attacker to execute arbitrary code.

All Linux kernel releases that retain the old SCTP code without the patch. No specific version information is supplied, so any kernel that has not applied the commit series in the kernel git repository is affected.

The CVSS score of 8.8 indicates high severity, and the EPSS score of < 1% suggests the vulnerability is rarely exploited currently. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker would need to initiate SCTP traffic that creates a large peer list and then issue a diagnostic request. The likely attack vector is remote access via SCTP to trigger the overflow, which can lead to kernel memory corruption and potentially arbitrary code execution. The lack of a published exploit does not reduce the risk, since an out‑of‑bounds write in the kernel is a high‑severity condition.