A critical vulnerability in the FreeBSD kernel's SCTP packet parsing allows unauthenticated remote attackers to crash systems via a stack overflow.

This flaw involves uncontrolled recursion (CWE-674) during the parsing of SCTP chunk parameters. An unauthenticated remote attacker can send crafted packets to trigger a stack overflow and subsequent system panic, regardless of the pf ruleset configuration.

The potential for a remote system panic presents a significant risk to service availability and operational continuity. With a CVSS score of 7.5, this vulnerability is categorized as High, reflecting the ease of exploitation over the network without requiring authentication. Successful exploitation results in an immediate denial of service, potentially impacting critical infrastructure or internet-facing services relying on FreeBSD.

Immediate Action: Update affected FreeBSD systems to the patched releases identified in the FreeBSD security advisory (FreeBSD-SA-26:14.pf).

Proactive Monitoring: Monitor system logs for kernel panics or unexpected reboots, and inspect network traffic for anomalous SCTP packets that deviate from expected protocol behavior.

Compensating Controls: While a WAF may not filter deep kernel-level protocol parsing, ensure that perimeter firewalls are configured to drop unsolicited or malformed SCTP traffic where such traffic is not explicitly required for business operations.

Public Exploit Available: No (exploit_available: false)

Given the ease of exploitation and the potential for a complete system crash, administrators should prioritize the application of the vendor-provided patches. Immediate patching is the only definitive way to eliminate the vulnerability. If immediate patching is not feasible, restrict network access to the affected SCTP services to trusted sources only.