Hi, Thank you for bringing this to oss-security.
On Thu, Aug 06, 2026 at 07:33:31PM +0800, Fourie Zhang wrote: > - Rocky Linux 9 / RHEL 9-family target, vendor 5.14 kernel (SCTP loaded) On these distros, the SCTP module is not part of a typical install, but is in the kernel-modules-extra subpackage. Further, that subpackage includes module blacklist files with: blacklist sctp blacklist sctp_diag which prevents unprivileged autoload of these modules on demand. So the sysadmin would have to explicitly install kernel-modules-extra and load the SCTP module to expose this vulnerability, meaning that in practice it would only be exposed on systems that actually use SCTP. Of course, exposure likely varies by distro. The above is just about the RHEL family distros with their recent kernels. Alexander
