A critical use-after-free vulnerability in the Linux kernel SCTP stack could allow a remote attacker to achieve arbitrary code execution or cause a system crash.

The vulnerability exists in the SCTP (Stream Control Transmission Protocol) subsystem where the kernel fails to clear a pointer to a transport object after it has been removed during an ASCONF operation. An attacker can trigger this by sending an ASCONF chunk that adds and then removes a peer transport, leading to a use-after-free condition when the kernel later attempts to access the freed memory via a HEARTBEAT chunk.

The flaw carries a CVSS score of 9.8, reflecting its potential for total system compromise. Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code with kernel-level privileges, leading to complete system takeover, data exfiltration, or persistent denial of service. Such an impact could result in significant operational disruption and the compromise of sensitive data stored on affected servers.

Immediate Action: Update the Linux kernel to version 5.10.265, 5.15.216, 6.1.183, 6.6.152, or newer, depending on the specific branch in use.

Proactive Monitoring: Monitor network traffic for anomalous SCTP ASCONF patterns or unexpected kernel crashes that may indicate exploitation attempts.

Compensating Controls: If patching is not immediately feasible, disable SCTP protocol support at the OS or network level if it is not required for business operations.

Public Exploit Available: Unknown

Given the critical severity of this vulnerability and its potential for remote code execution, organizations should prioritize patching affected Linux kernels immediately. Administrators should verify their current kernel versions against the provided fixed releases and coordinate reboot cycles to apply these security updates, as kernel patches cannot be fully applied without restarting the system.