A critical vulnerability in the Linux kernel SCTP stack can be exploited by an unauthenticated attacker to trigger a system-wide denial of service.

The sctp_process_strreset_inreq function fails to validate the stream count when processing a RESET_IN_REQUEST from a peer. This can lead to an integer overflow when calculating the size for an outgoing request, resulting in an undersized buffer allocation and a kernel BUG or panic.

This vulnerability carries a CVSS score of 7.5, indicating a high severity risk primarily due to the potential for service disruption. Successful exploitation allows an unauthenticated remote attacker to crash the affected system, resulting in significant downtime for critical infrastructure or business applications relying on the Linux kernel.

Immediate Action: Apply the latest kernel security updates provided by your distribution vendor, specifically ensuring the kernel is upgraded to at least 5.10.265, 5.15.216, 6.1.183, or 6.6.148.

Proactive Monitoring: Monitor system logs for kernel BUG messages or unexpected system reboots, and utilize network monitoring tools to detect anomalous SCTP traffic patterns.

Compensating Controls: If immediate patching is not feasible, restrict access to SCTP services using firewall rules or iptables to limit exposure to trusted network segments.

Public Exploit Available: Unknown.

Given the potential for remote denial of service, organizations should prioritize patching their Linux kernel environments. Administrators must verify their current kernel version and apply the recommended updates immediately to eliminate this risk of system instability.