This vulnerability involves a mismatch in how the Linux kernel parses ASCONF‑ACK parameters in the SCTP protocol. The verifier advances with a padded length while the consumer uses the raw length, leading to misalignment when an odd‑length parameter is present. An attacker can send a crafted ASCONF‑ACK chunk that desynchronizes the walks, causing the consumer to read zero‑length values and loop indefinitely in softirq context. The result is a kernel soft lockup, providing a remote denial‑of‑service condition. Additionally, the verifier performs no length check for SCTP_PARAM_ERR_CAUSE parameters, allowing an out‑of‑bounds read of the error header.

The flaw resides in the Linux kernel, affecting all builds that include the SCTP subsystem before the patch was introduced. No specific version numbers are enumerated in the advisory, so any kernel where SCTP is enabled and the bug remains present is vulnerable. The CVE data identifies the affected system as the Linux kernel OS via the generic CPE string.

The attack can be carried out remotely from a peer that initiates a SCTP association with the ADD‑IP feature and possessing an outstanding ASCONF transaction. Because the attacker can compute the required HMAC using the public key id 0, the authentication gate does not provide protection. No CVSS score is published and EPSS is not available, but the remote nature and the potential to cause a soft lockup suggest a high severity. The vulnerability is not listed in CISA’s KEV catalogue at the time of this analysis.