The vulnerability in the Linux kernel SCTP subsystem involved the addip_last_asconf pointer caching an outstanding outbound ASCONF chunk. While the normal ASCONF-ACK completion path correctly released the chunk and cleared the pointer, the sctp_asconf_queue_teardown() function released the cached chunk without clearing the pointer, leaving a dangling reference. During peer restart handling, a delayed authenticated ASCONF-ACK could access this stale pointer, causing a use-after-free and a second release of the chunk. Additionally, a race condition with timer T4 expiry could lead to a NULL pointer dereference. The fix involved clearing the addip_last_asconf pointer after releasing the chunk and modifying sctp_sf_t4_timer_expire() to safely handle stale timer expiries when no outstanding ASCONF remains.

The vulnerability could lead to use-after-free conditions and NULL pointer dereferences within the SCTP kernel code, potentially causing kernel crashes or memory corruption. No known exploits in the wild have been reported. The impact is limited to systems running the affected Linux kernel SCTP implementation.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch. Since no vendor advisory or patch links are provided here, users should monitor the official Linux kernel repositories or trusted vendor advisories for the relevant patch. Patch status is not yet confirmed in this data — check the vendor advisory for current remediation guidance.