In the Linux kernel, the SCTP_CMD_TIMER_START handler checks timer_pending() before calling timer_reduce(). If the timer expires and detaches between those calls, timer_reduce() can re‑arm the timer without acquiring the required association reference. This race condition is a CWE‑362 flaw, and the unbalanced reference count later causes a use‑after‑free (CWE‑825) when the callback unconditionally drops its reference. The flaw can corrupt memory or crash the kernel, depending on how the freed memory is subsequently used.

All builds of the Linux kernel that include the SCTP subsystem are affected. The vendor list identifies Linux as the vendor and the CPE string confirms the Linux kernel. No specific kernel versions are enumerated, indicating that any kernel containing the unpatched SCTP code is at risk.

The CVSS score of 8.1 indicates high severity. The EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a race condition in SCTP traffic that requires precise timing and crafted packets to trigger the timer sequence. Exploitation would entail manipulating SCTP packets to exploit the timer race, after which the use‑after‑free could corrupt memory or crash the kernel. Because the flaw requires a race condition and precise packet crafting, it is considered non‑trivial to exploit.