A vulnerability in the Linux kernel SCTP stack could allow an unauthenticated remote attacker to cause a denial of service through an integer underflow.

The vulnerability exists within the SCTP protocol implementation, specifically in how the kernel processes RECONF chunks. An unauthenticated attacker can send duplicate RECONF responses, causing the kernel to process the same request multiple times and underflow the stream outcnt counter, leading to a kernel-level denial of service.

The exploitation of this vulnerability results in a denial of service condition, which can render affected network services unreachable or crash the host system. Given the CVSS score of 7.5 (High) and the ability for remote, unauthenticated attackers to trigger the crash, this represents a significant risk to the availability of critical infrastructure running affected Linux kernels.

Immediate Action: Update the Linux kernel to the versions specified in the OSV fixed packages list (e.g., 6.1.188, 6.12.109, 6.18.50, or 7.2.4) or the latest stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for unexpected kernel panics or SCTP-related errors that may indicate exploitation attempts.

Compensating Controls: If patching is not immediately feasible, restrict access to SCTP traffic via network firewalls to trusted sources only, as the vulnerability requires the ability to establish or interact with SCTP associations.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to system availability through remote exploitation. Administrators should prioritize the application of kernel security updates across all exposed systems as soon as they become available from their Linux distribution maintainers to eliminate this denial of service vector.