SCTP stands for Stream Control Transmission Protocol. It is a transport-layer protocol used for reliable, message-oriented communication. Unlike classic byte-stream protocols, SCTP preserves message boundaries and supports features such as multihoming and multiple ordered streams. In Linux, SCTP is implemented in kernel networking code, so traffic that reaches it is handled in privileged system space.
That matters in cyber security because kernel protocols expand the attack surface. A bug in SCTP can affect the whole host, not just one application, and may lead to crashes, memory corruption, or privilege escalation. Attackers look for these weaknesses when a service exposes SCTP or when the protocol is enabled but rarely used. Defenders reduce risk by patching the kernel, disabling SCTP where it is unnecessary, and auditing systems to confirm whether the protocol is reachable from untrusted networks.