CVE-2025-40281

A shift-out-of-bounds flaw was found in the SCTP implementation in the Linux kernel. When rto_alpha or rto_beta sysctl values are set excessively large, sctp_transport_update_rto() can perform a bit shift with an exponent exceeding the type's bit width, causing undefined behavior per UBSAN.

Triggering requires either malicious sysctl settings (privileged) or unusual SCTP configurations. Default values are safe. UBSAN catches this as undefined behavior, but practical exploitation for code execution is unlikely.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.