The vulnerability in the Linux kernel SCTP subsystem involves sctp_make_heartbeat_ack() caching the destination transport in chunk->transport without a reference. When src_out_of_asoc_ok is enabled, HEARTBEAT ACK chunks may remain queued instead of being sent immediately. If the peer transport is removed during this time, sctp_assoc_rm_peer() drops and schedules the transport for freeing but only clears cached transport pointers in out_chunk_list, not in control_chunk_list. Consequently, queued control chunks retain dangling transport pointers. Upon transmission triggered by an ASCONF_ACK, SCTP dereferences the stale pointer, causing a use-after-free. The fix clears chunk->transport for queued control chunks in control_chunk_list when removing the transport.

This use-after-free vulnerability could lead to kernel memory corruption, potentially causing system crashes or other undefined behavior. The exact impact depends on exploitation conditions but involves dereferencing freed memory within the SCTP kernel code.

A fix has been implemented in the Linux kernel to clear cached transport pointers for queued control chunks when the transport is removed, preventing use-after-free. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.