In the Linux kernel the SCTP_CMD_TIMER_START handler previously performed a timer_pending check before calling timer_reduce. During the brief window between these two calls the timer could expire and detach, causing timer_reduce to rearm the timer without acquiring the association reference needed for the newly armed timer. The timer callback then unconditionally drops its association reference, which can leave the reference count unbalanced and result in a use‑after‑free during association teardown. The resulting memory corruption could allow an attacker to execute arbitrary code with kernel privileges, potentially enabling privilege escalation.

All Linux kernel builds that include the SCTP subsystem are affected. The exact kernel versions are not listed in the CVE data, so any kernel installation containing the unpatched SCTP module is potentially vulnerable.

The severity of this bug is high given that it is a kernel use‑after‑free. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so no public exploit reports are known at this time. The attack likely requires local or remote access to the SCTP service and control over the SCTP association, but the kernel nature of the flaw means successful exploitation could lead to arbitrary code execution or privilege escalation. The absence of a public exploit and the need for a race condition reduce the immediate risk, yet the potential impact warrants prompt action.