The Linux kernel’s SCTP implementation incorrectly accepts SCTP parameters that contain only a header, without validating that the declared length matches the fixed 32‑bit Adaptation Code Point structure. When a malformed parameter is the last field in an INIT message, the kernel reads beyond the provided length onto the receive socket buffer tail, copying four stray bytes into the state cookie returned in the INIT ACK. An attacker who can send crafted SCTP INIT packets can therefore gain access to a small amount of transient kernel memory, potentially revealing sensitive information. This flaw arises from improper bounds checking in the SCTP parameter handling code.

All Linux kernel installations are affected, regardless of vendor, because the vulnerability resides in the core SCTP stack. No specific kernel release or distribution version is listed, so any kernel containing the unpatched SCTP handling code is considered vulnerable.

The vulnerability allows remote attackers to send a malicious SCTP packet and receive a partially corrupted state cookie containing four bytes of receive‑buffer data. The lack of an exploitation record and the absence of a KEV listing suggest a moderate likelihood of being targeted. However, exploitation requires a SCTP‑capable network stack and the ability to send crafted packets to the target host, limiting the threat to environments where SCTP is enabled. Immediate patching is recommended, as no mitigations can fully prevent the disclosure once the vulnerable code is active.