The Linux kernel SCTP subsystem contains a race condition in its timer handlers. The code invokes mod_timer() before acquiring a reference to the SCTP association or transport and before holding the sock lock. If the timer is deleted after mod_timer() returns but before the reference is taken, the cleanup path can drop the timer’s reference and destroy the object. The subsequent handler then operates on the freed object, leading to a reference‑count underflow. The CVE description notes this underflow and its potential to affect kernel stability, but it does not explicitly state a crash or corrupted memory. The weakness is a classic reference‑counting race identified by CWE-911.

All Linux kernel releases that incorporate the SCTP protocol implementation are affected. The vendor is the Linux kernel project and the product is the Linux kernel. No specific version constraints are provided, so the flaw is presumed present in any unpatched build that contains SCTP.

The CVSS score of 5.9 indicates moderate severity. The EPSS score of <1% suggests a very low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The race revolves around SCTP timer handling, implying that an attacker would need to interact with SCTP traffic—such as by sending crafted SCTP packets—to induce the condition. The CVE description does not confirm whether remote trigger is feasible; thus, the risk is best viewed as moderate severity but low exploitation probability for most deployment scenarios.