CVE-2024-49944

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A local user can trigger this issue by creating an SCTP socket and inducing an automatic port-binding failure during a listen operation. Because the socket state is not properly reset after the failure, a subsequent listen attempt leads to a null-pointer dereference, resulting in a system crash and a denial of service (DoS).

This vulnerability is evaluated as having a Moderate impact because exploitation requires local user access and results exclusively in a kernel denial of service, with no impact on system confidentiality or integrity. An unprivileged local user must be able to create SCTP sockets and induce an autobind failure to trigger the invalid socket state and subsequent crash. Under default Red Hat Enterprise Linux configurations, the SCTP kernel module is not loaded unless explicitly enabled or required by specific networking services.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.