In the Linux kernel’s SCTP implementation, a race condition exists while an association is waiting for a connect. The socket lock is released during sleep; a concurrent ABORT event can free the association. If a shutdown with SHUT_RD has already set RCV_SHUTDOWN, the waiting code exits with an error before verifying the association’s validity. The subsequent sctp_sendmsg_to_asoc() continues to use the freed association, resulting in a dereference of a dangling pointer that may corrupt kernel memory. The vulnerability is a classic use‑after‑free with inadequate reference handling (CWE‑825).

All Linux kernel releases that include the unpatched SCTP logic are affected. No specific version range is listed, so any kernel that compiled the SCTP module before the patch commit is potentially vulnerable.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is less than 1 % and the flaw is not in the CISA KEV catalog, suggesting the likelihood of a public exploit is low. However, the description indicates that the flaw can be exercised by sending crafted SCTP packets over the network, so an attacker with sufficient network access could potentially cause a kernel memory corruption, crash the host, or create an escalation path. Organizations should treat this as a moderate risk that warrants immediate remediation.