A race condition in the Linux kernel SCTP stack allows an authenticated ASCONF DEL‑IP operation to remove a transport while a pending data chunk still references it. The removal causes the transport structure to be freed, after which delayed SACK processing inadvertently dereferences the stale pointer. This leads to a kernel crash, rendering the host unavailable and providing a denial‑of‑service vector. The vulnerability is identified as a resource management error consistent with CWE‑825.

Linux kernels with SCTP support that have not yet incorporated commit 03a9d10ecf71f54b2af8020935f2033d4a132be5 are affected. This includes most distributions that ship with SCTP enabled in the kernel and have not applied the fix.

The CVSS score of 5.9 signifies a moderate severity level, but the impact of a kernel crash remains critical for availability. The EPSS score of less than 1% indicates that while verified exploitation is considered unlikely, the possibility remains real. The flaw is not cataloged in CISA KEV, but it requires an attacker with the privilege to issue an ASCONF DEL‑IP command on an SCTP association, meaning a local or privileged attacker. Successful exploitation would terminate the operating system’s kernel, causing service disruption; no known remote exploitation vectors or public exploits are documented.