CVE-2026-74469

Received Received - Intake

SCTP Peer Transport Count Overflow in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, then copies one sockaddr_storage for every entry in transport_addr_list. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail. Reject a new unique peer when transport_count has reached U16_MAX. Perform the check after the existing-peer lookup so a duplicate address continues to return its existing transport at the limit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74469

EUVD

EUVD-2026-59662

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the SCTP protocol where the transport_count variable, a 16-bit integer, can overflow when incremented beyond its maximum value of 65,535. This causes the count to wrap around to zero, leading to incorrect memory handling during diagnostic operations.

Detection Guidance

This vulnerability can be detected by checking for excessive SCTP transport entries in the Linux kernel. Monitor for kernel logs indicating transport_count overflows or abnormal SCTP diagnostic dumps. Use commands like 'ss -S' or 'netstat -S' to inspect SCTP connections and peer counts. Kernel messages may show errors related to INET_DIAG_PEERS payload handling.

Impact Analysis

An attacker could exploit this to cause a denial-of-service by triggering the overflow, leading to excessive memory writes and potential system crashes. It may also allow unauthorized access to sensitive data if memory corruption occurs.

Compliance Impact

This vulnerability could lead to unauthorized data access or system disruption, violating confidentiality and availability requirements in GDPR and HIPAA. Organizations must patch to maintain compliance.

Mitigation Strategies

Apply the latest Linux kernel patches to address the transport_count overflow issue. Restrict SCTP traffic if possible by disabling unused SCTP services or using firewall rules. Monitor kernel logs for signs of exploitation attempts or abnormal SCTP activity.

Hi! I’m here to help you understand CVE-2026-74469. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70