The vulnerability appears in the SCTP implementation in the Linux kernel. A cached RECONF chunk may contain multiple request parameters. When a duplicate RECONF response arrives, the kernel processes the same ADD_OUT request twice while another parameter remains outstanding. This double decrement causes the stream->outcnt counter to underflow. The underflow corrupts a kernel memory structure, leading to unpredictable behavior such as a crash or other integrity violations.

All Linux kernel versions that include the SCTP stack and were released before potentially affected. Kernel builds that do not incorporate the patches referenced in the advisory, specifically commits 2d867663c563e8009257b9edf9c8ec75d9bbf19a, 3faf13aff243ca9f78d08b1a2956ef5a6fc77b6e, 8320cbd81bc21a1ca6ebdf68, and d02a5794c3deedcb8476d017fcee2b7aaedab2e1, may kernel older than these commits should be evaluated.

The CVSS score of 5.9 indicates a moderate risk. EPSS < 1% suggests a very low likelihood of exploitation, and the vulnerability is not listed in the KEV catalog, indicating limited exploitation evidence. Likely attack requires network access to a host’s SCTP port to transmit crafted RECONF messages that trigger duplicate responses. The double decrement of outcnt could cause a kernel crash or other instability due to kernel memory corruption.