The vulnerability in the Linux kernel SCTP subsystem involved the sctp_rcv() function resolving transport references per packet and storing them in chunk->transport. An authenticated ASCONF DEL-IP message could remove the transport concurrently, causing sctp_assoc_rm_peer() to mark the transport dead and free it after RCU grace period. However, a DATA chunk referencing the removed transport could remain on the socket backlog or direct path, leading to a delayed SACK carrying a pointer to freed transport memory. This use-after-free was mitigated by dropping such chunks in sctp_inq_push() when the transport is detected as dead, ensuring the socket lock is held during this check.

The vulnerability could lead to use-after-free conditions in the SCTP transport handling within the Linux kernel, potentially causing kernel memory corruption or crashes. Exploitation requires authenticated access to send ASCONF DEL-IP messages, limiting the attack surface. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to drop SCTP chunks referencing removed transports in sctp_inq_push(). Users should update to the patched Linux kernel versions containing this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation.