The Linux kernel SCTP subsystem improperly reads a 4-byte Measure of Staleness field following a STALE_COOKIE cause header in an ERROR chunk during the COOKIE_ECHOED state. The code incorrectly reads from the first cause in the chunk rather than the STALE_COOKIE cause, which may be shorter than expected. This leads to out-of-bounds reads past the cause or even past the skb tail, leaking uninitialized kernel memory to the peer in the Cookie Preservative of the reply INIT. The vulnerability is reachable by any peer that can drive an association into COOKIE_ECHOED, including unprivileged users with raw SCTP socket access. The fix involves checking the length of the STALE_COOKIE cause before reading and discarding causes that are too short.

An attacker can leak uninitialized kernel memory contents remotely without privileges, potentially exposing sensitive information. The vulnerability does not affect integrity but impacts confidentiality and availability due to the kernel reading out-of-bounds memory and possible kernel instability. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to raw SCTP sockets to trusted users to prevent unprivileged processes from exploiting this vulnerability. Monitor vendor channels for updates and apply patches promptly once released.