The Linux kernel SCTP stack has a use‑after‑free bug that allows a crafted packet containing a COOKIE ECHO, SHUTDOWN or SHUTDOWN ACK to delete an association while the endpoint loop still processes remaining chunks that reference the freed transport. The resulting memory corruption can cause a kernel crash or, if the attacker can control the freed memory, arbitrary code execution. The issue is classified as CWE‑825.

The vulnerability affects Linux kernel releases that provide the SCTP protocol stack. No specific kernel version numbers are cited in the advisory, so the fix is applicable to any kernel build that contains the SCTP implementation before the patch commit. All systems that enable the SCTP for SCTP traffic are subject to the flaw.

With a CVSS score of 5.9 the vulnerability has moderate severity. The EPSS score is < 1%, indicating a low probability of exploitation, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is remote, as an adversary can send crafted SCTP packets to the target host. The attacker must bundle COOKIE ECHO, SHUTDOWN, and SHUTDOWN ACK chunks in a single packet to trigger the use‑after‑free sequence. Successful exploitation could result in a denial‑of‑service or, if the attacker can control the freed memory, kernel‑level code execution. The recommended mitigating action is to apply the kernel patch or, if that is not immediately possible, disable SCTP.