In the Linux kernel the SCTP transport layer contains a use‑after‑free bug that is triggered when an outstanding ASCONF chunk is cached but not cleared after a queue teardown. The stale pointer is later dereferenced during an authenticated ASCONF‑ACK, allowing an attacker to read or overwrite kernel memory. This memory corruption can lead to arbitrary code execution in kernel mode, granting the attacker root privileges. The bug also introduces a NULL‑pointer dereference race via the T4 timer, potentially causing a denial‑of‑service by crashing the kernel.

All Linux kernel implementations that use SCTP are potentially affected, regardless of distribution. The fix is applied in the mainline kernel through a series of commits, but no specific stable release is named in the advisory, so systems running a kernel that has not incorporated these patches remain vulnerable.

The CVSS score is not publicly available and the EPSS score is missing, but the absence of a KEV listing does not diminish the severity of kernel memory corruption. An attacker can initiate the flaw by sending crafted SCTP packets over an established or restart‑induced association, which is an external vector. Due to the need to manipulate SCTP state, the attack requires network visibility and some protocol knowledge. Overall risk is high because a successful exploit would grant unrestricted kernel access, and exploitation is plausible with existing network traffic.