The flaw occurs in the Linux kernel’s SCTP subsystem when a HEARTBEAT ACK chunk stores a transport pointer without acquiring a reference. If an associated peer transport is removed while the chunk remains queued, the kernel clears the pointer only in the out_chunk_list but leaves a dangling reference in queued control chunks. When the control chunk later transmits, the kernel dereferences this stale pointer, causing a use‑after‑free that can crash the kernel or allow privilege escalation. The weakness aligns with CWE‑825.

All Linux kernel builds that include the SCTP module and have not yet incorporated the commit that clears chunk->transport for queued control chunks when a peer transport is removed are vulnerable. The patch that fixes the issue is included in recent kernel releases; any kernel lacking that commit remains susceptible.

The CVSS score is 9.8 and the EPSS score is below 1 %, indicating a high‑severity bug but a very low probability of exploitation at present. In the CISA KEV catalog the vulnerability is not listed, meaning no publicly documented exploits exist. It is inferred that the attack vector requires an adversary capable of sending crafted SCTP packets to the target; an attacker would need network or local access to the affected kernel instance to trigger the use‑after‑free. Kernel‑level use‑after‑free bugs are notoriously difficult to exploit reliably, yet when achieved they can deliver denial of service or privilege escalation with system‑wide impact.