CVE-2026-99165 is a vulnerability in the Linux kernel SCTP implementation where improper validation of output streams after association connect wait can lead to a null pointer dereference. This occurs when message interleaving is enabled and the socket lock is dropped during association establishment, allowing handshake processing to reduce the output stream count and free extensions of removed streams. Subsequent send operations may dereference these freed extensions, causing kernel panic.