Linux Kernel EUVD-2026-39197

Exploitation requires the target host to have the SCTP module loaded and an SCTP server actively listening/accepting associations - this is the decisive prerequisite and is non-default on most Linux systems. Given that, no authentication or user interaction is needed (CVSS PR:N/UI:N): the attacker reaches the COOKIE_ECHO processing path and supplies a crafted cached INIT chunk with a length field larger than the remaining COOKIE_ECHO payload. Limiting factors: SCTP must be enabled and network-reachable to the attacker; firewalling or absence of SCTP services eliminates exposure entirely. The most reliably achievable impact is a kernel crash (DoS); full memory corruption/code execution is described as only 'potential' and not demonstrated.

The signals conflict and warrant nuance. The kernel-assigned CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) implies trivial, fully unauthenticated remote compromise, but several factors temper real-world risk: SCTP is not enabled or loaded by default on most Linux deployments, so the attack surface exists only where an SCTP listening service is actually running (telecom/SIGTRAN, some WebRTC, and specialized middleware). The description itself characterizes the primary impact as out-of-bounds reads with only 'potential' memory corruption, so the I:H/C:H claims are partly speculative - a denial-of-service crash is the most certain outcome. EPSS is low (0.17%, 7th percentile), there is no KEV listing and no public exploit identified at time of analysis, indicating this is not currently being exploited at scale. Net assessment: genuinely network-reachable and pre-authentication where SCTP is exposed, but realistic priority is moderate and gated by whether SCTP is in use, not a drop-everything internet-wide threat. The 9.8 is a worst-case rating that should be downgraded for hosts without SCTP listeners.

An attacker reachable to an SCTP listening service (no prior authentication or association needed) completes enough of the handshake to send a COOKIE_ECHO chunk containing a cached INIT chunk with a deliberately inflated header length. When the server unpacks the cookie and walks the INIT parameters, the kernel reads beyond the received buffer, crashing the host or potentially corrupting heap memory during STATE_COOKIE processing and kmemdup() copies. No public exploit is identified at time of analysis, so this remains a theoretical-but-credible scenario.