Shift-Out-Of-Bounds Vulnerability in Linux Kernel SCTP Transport

CVE-2025-40281

What is CVE-2025-40281?

A shift-out-of-bounds vulnerability exists in the SCTP (Stream Control Transmission Protocol) component of the Linux kernel. This issue can arise during the updating of retransmission timeouts (RTO), particularly if users set excessively large values for 'rto_alpha' and 'rto_beta'. The bug could lead to unpredictable behavior as the system might attempt to perform operations beyond the acceptable range for 32-bit unsigned integers. It is essential for system administrators and developers to ensure their Linux kernel remains up-to-date and adequately configured to prevent potential exploitation.

References