CVE-2026-74287

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted SCTP packet with a malformed embedded address parameter. This could lead to an out-of-bounds read, potentially allowing for information disclosure or system instability.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because the SCTP kernel module is not loaded by default and requires dedicated networking services to process traffic. While malformed address parameters in SCTP packets could cause an out-of-bounds read resulting in a system denial of service or potential information disclosure, exploitation is restricted to systems actively handling SCTP associations. Standard installations that do not run SCTP-based applications do not expose this attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.