In the Linux kernel, the SCTP_CMD_TIMER_START handler checks timer_pending() before calling timer_reduce(). If the timer expires and detaches between those calls, timer_reduce() can re‑arm the timer without acquiring the required association reference. The associated callback later drops its reference unconditionally, causing the reference count to become negative and leading to a use‑after‑free during association teardown. This flaw can corrupt memory or crash the kernel, depending on how the freed memory is subsequently used.

All builds of the Linux kernel that include the SCTP subsystem are affected. The vendor list identifies Linux as the vendor and the CPE string confirms the Linux kernel. No specific kernel versions are enumerated, indicating that any kernel containing the unpatched SCTP code is at risk.

The CVSS score of 8.1 indicates high severity. The EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a race condition in SCTP traffic that requires precise timing and crafted packets to trigger the timer sequence. Exploitation would entail manipulating SCTP packets to exploit the timer race, after which the use‑after‑free could corrupt memory or crash the kernel. Because the flaw requires a race condition and precise packet crafting, it is considered non‑trivial to exploit.