In the Linux kernel, a use‑after‑free flaw exists in the SCTP implementation. When an outstanding ASCONF chunk is cached, the normal ASCONF‑ACK path clears the pointer, but a separate teardown routine releases the chunk without clearing the cache entry. If a duplicate packet queue removal takes place while the association is still alive, the stale pointer remains dangling. A delayed authenticated ASCONF‑ACK can later reach the state machine and dereference this memory, causing a use‑after‑free and a second release. Additionally, a race with the T4 timer can lead to a null‑pointer dereference if a callback runs after the purge. The result is kernel memory corruption that is inferred to allow arbitrary code execution with root privileges.

All Linux kernel builds that enable SCTP are potentially affected, regardless of distribution or vendor. The advisory notes that the fix is applied in the mainline kernel via a series of commits, but no distribution‑specific release is named, meaning any system running a kernel that has not incorporated these commits remains vulnerable.

The CVSS score is 9.8 and the EPSS score is <1%, indicating a high severity but an uncommon exploit window. The likely attack vector is over the network, where an attacker sends crafted SCTP packets to trigger the flaw. Because the flaw requires interaction with the SCTP state machine, an attacker needs network visibility and protocol knowledge. The vulnerability is inferred to allow kernel code execution, but there is no evidence of current exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog.