CVE-2025-40240

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. When processing packet chunks with missing data buffers, the kernel can dereference a null pointer. A remote attacker could exploit this vulnerability by sending specially crafted SCTP packets to an active SCTP service, causing a kernel crash and resulting in a denial of service (DoS).

A missing data buffer (frag_list) in SCTP chunk processing could trigger a NULL pointer dereference when handling GSO packets. A remote attacker sending a malformed SCTP packet could cause a kernel crash (DoS). The system is vulnerable only if CONFIG_IP_SCTP enabled in Kernel configuration (and for the Red Hat Enterprise Linux it is always disabled in older versions and enabled as module in latest versions only). However even if module exists in Red Hat Enterprise Linux, still admin need to specially enable it usage (make some SCTP listening port available) before exploitation would be possible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module sctp from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.