Linux SCTP Stream Scheduler Flaw Enables Local Denial of Service

CVE-2023-2177 is a moderate-severity NULL-pointer dereference in the Linux kernel's SCTP stream scheduler, in net/sctp/stream_sched.c. On kernels before version 5.19, a failed stream_in allocation can free stream_out before later code accesses it. A local low-privileged user could trigger a kernel crash and cause denial of service; the issue has no reported confidentiality or integrity impact and carries a Red Hat CVSS v3.1 score of 5.5.

An upstream patch corrected SCTP association and stream-initialization error handling by routing failed sctp_stream_init() operations through the dedicated stream cleanup path and centralizing allocation-failure cleanup. Red Hat issued errata for affected Red Hat Enterprise Linux 8, RHEL 8.6 Extended Update Support, and RHEL 9 kernel packages; RHEL 6 and 7 variants were listed as not affected. Organizations should deploy the applicable kernel updates, as no separate mitigation is available.