CVE-2026-64551

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP). This vulnerability allows a remote attacker or a local unprivileged user to potentially access and disclose sensitive information. By sending a malformed error message, the system can be tricked into reading and then leaking uninitialized memory, which is then sent back to the attacker.

Red Hat has evaluated this issue as having a Moderate severity because, while an attacker can potentially leak uninitialized kernel memory, the SCTP module is not loaded or used by default in standard Red Hat Enterprise Linux installations. Exploiting this vulnerability requires either an actively running SCTP service or local privileges capable of creating network namespaces to open raw SCTP sockets. Systems that do not run SCTP workloads or do not expose user namespaces are not vulnerable to remote exploitation under default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.