During an SCTP ASCONF exchange the kernel stores a newly added transport in the asoc->new_transport field. If an authenticated peer adds a transport and immediately removes it with a wildcard DEL‑IP parameter, the removal frees the transport but leaves asoc->new_transport pointing to the freed object. Later, sctp_sf_do_asconf uses that pointer to create a HEARTBEAT on the removed transport. The kernel then reads from a freed memory area, triggering a KASAN slab-use‑after‑free read of the transport state. The flaw is classified as CWE‑825 and can lead to a kernel crash or panic.

Any Linux kernel that has the SCTP stack compiled and enabled is vulnerable. The advisory does not specify a version range; therefore, any current kernel build that accepts SCTP connections could be at risk unless SCTP support has been removed or the kernel has been updated to include the fix. Kernels with SCTP disabled or compiled out are not affected.

The CVSS score of 9.8 indicates very high severity. The EPSS score is less than 1 %, indicating low current exploitation probability. The vulnerability requires an authenticated SCTP session, so only hosts that accept SCTP connections from potential attackers are affected. A successful exploitation can cause a kernel crash or panic. No public exploit has been reported and it is not listed in CISA KEV, but it should be treated as a critical risk until a patch is applied.