The Linux kernel’s SCTP implementation accepts SCTP parameters that contain only a header without validating that the declared length matches the fixed 32‑bit Adaptation Code Point structure. When a malformed parameter is the last field in an INIT message, the kernel reads beyond the provided length onto the receive socket buffer tail, copying four stray bytes into the state cookie returned in the INIT ACK. An attacker who can send crafted SCTP INIT packets can therefore gain access to a small amount of kernel memory, potentially revealing sensitive information. This flaw arises from improper bounds checking in the SCTP parameter handling code.

All Linux kernel installations are affected, because the vulnerability resides in the core SCTP stack. No specific kernel release or distribution version is listed, so any kernel containing the unpatched SCTP handling code is considered vulnerable.

The vulnerability allows remote attackers to send a malicious SCTP packet and receive a partially corrupted state cookie containing four bytes of receive‑buffer data. The CVSS score of 7.5 reflects high severity. The EPSS score of < 1 % indicates a very low probability of exploitation, and the absence of a KEV listing confirms that no publicly documented exploits exist. Exploitation requires a SCTP‑capable network stack and the ability to send crafted packets to the target host, limiting the threat to environments where SCTP is enabled. The attack vector is inferred from the description, implying that an attacker must send malicious SCTP INIT packets to the target host. Immediate patching is recommended, as no mitigations can fully prevent the disclosure once the vulnerable code is active.