CVE-2026-74469 (GCVE-0-2026-74469)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:37
VLAI
Title
sctp: prevent peer transport count overflow
Summary
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, then copies one sockaddr_storage for every entry in transport_addr_list. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail. Reject a new unique peer when transport_count has reached U16_MAX. Perform the check after the existing-peer lookup so a duplicate address continues to return its existing transport at the limit.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8f840e47f190cbe61a96945c13e9551048d42cef , < b453e00da1211e997b82743d28af7714c59c05c8 (git)
Affected: 8f840e47f190cbe61a96945c13e9551048d42cef , < dfea32dd76f390e3155177b0038cc47b01386198 (git)
Affected: 8f840e47f190cbe61a96945c13e9551048d42cef , < 80f48523a0fe42db2e7375dff4e38a25c117090a (git)
Affected: 8f840e47f190cbe61a96945c13e9551048d42cef , < 546221b86ceeba0d8fec92d46a0604bb7b62be07 (git)
Affected: 8f840e47f190cbe61a96945c13e9551048d42cef , < 09e722030e8148ba4ed1e42c6b2ea57bda9f9895 (git)
Affected: 8f840e47f190cbe61a96945c13e9551048d42cef , < 4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0 (git)
Affected: 8f840e47f190cbe61a96945c13e9551048d42cef , < 6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75 (git)
Affected: 8f840e47f190cbe61a96945c13e9551048d42cef , < bd0e9289e2642f6a5c54faad304ce0f41e926d22 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/associola.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b453e00da1211e997b82743d28af7714c59c05c8",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            },
            {
              "lessThan": "dfea32dd76f390e3155177b0038cc47b01386198",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            },
            {
              "lessThan": "80f48523a0fe42db2e7375dff4e38a25c117090a",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            },
            {
              "lessThan": "546221b86ceeba0d8fec92d46a0604bb7b62be07",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            },
            {
              "lessThan": "09e722030e8148ba4ed1e42c6b2ea57bda9f9895",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            },
            {
              "lessThan": "4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            },
            {
              "lessThan": "6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            },
            {
              "lessThan": "bd0e9289e2642f6a5c54faad304ce0f41e926d22",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/associola.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: prevent peer transport count overflow\n\nsctp_assoc_add_peer() increments the association\u0027s 16-bit transport_count\nfor every new unique peer. Adding the 65,536th transport wraps the count to\nzero.\n\nSCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,\nthen copies one sockaddr_storage for every entry in transport_addr_list.\nAfter the wrap, a diagnostic dump reserves an empty payload and writes\n8 MiB of peer addresses past the skb tail.\n\nReject a new unique peer when transport_count has reached U16_MAX. Perform\nthe check after the existing-peer lookup so a duplicate address continues\nto return its existing transport at the limit."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Remote SCTP peers add unique transports via INIT address parameters and ASCONF ADD_IP chunks processed in sctp_assoc_add_peer(); this is network ingress on SCTP servers (telecom, signaling gateways) before any local diagnostic action.\nAC:L - An attacker controlling an SCTP association can script 65536 unique peer addresses via connectx, repeated ASCONF ADD_IP, or INIT parameters; no race or victim-specific state is required beyond reaching the transport limit.\nPR:L - The heap overflow is triggered via NETLINK_SOCK_DIAG (ss/netlink), reachable by unprivileged users; SCTP socket creation and connectx need no capabilities beyond a normal local account (including user namespaces).\nUI:N - Exploitation requires no victim interaction; the attacker drives transport accumulation and issues the diagnostic dump themselves.\nS:U - Impact is kernel heap corruption within the same kernel security boundary; this is not a VM escape, sandbox breakout, or cross-authority scope change.\nC:H - When transport_count wraps to zero, inet_diag_msg_sctpaddrs_fill() reserves no space but iterates all 65536 transports, writing ~8 MiB past the skb tail and enabling adjacent kernel heap reads.\nI:H - The same diag path performs a massive out-of-bounds write of sockaddr_storage entries past the allocated skb buffer, corrupting adjacent kernel heap objects and enabling control-flow hijacking.\nA:H - Corrupting sk_buff heap metadata and adjacent allocations via an ~8 MiB out-of-bounds write can cause kernel oops, panic, or hang, meeting high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:37:15.198Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b453e00da1211e997b82743d28af7714c59c05c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfea32dd76f390e3155177b0038cc47b01386198"
        },
        {
          "url": "https://git.kernel.org/stable/c/80f48523a0fe42db2e7375dff4e38a25c117090a"
        },
        {
          "url": "https://git.kernel.org/stable/c/546221b86ceeba0d8fec92d46a0604bb7b62be07"
        },
        {
          "url": "https://git.kernel.org/stable/c/09e722030e8148ba4ed1e42c6b2ea57bda9f9895"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd0e9289e2642f6a5c54faad304ce0f41e926d22"
        }
      ],
      "title": "sctp: prevent peer transport count overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74469",
    "datePublished": "2026-08-15T12:27:06.873Z",
    "dateReserved": "2026-08-15T05:44:03.902Z",
    "dateUpdated": "2026-08-19T16:37:15.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74469",
      "date": "2026-10-01",
      "epss": "0.01083",
      "percentile": "0.63935"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-25T01:59:56.000Z",
      "cve": "CVE-2026-74469",
      "id": "msrc_CVE-2026-74469",
      "initial_release_date": "2026-08-23T14:54:23.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "sctp: prevent peer transport count overflow",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74469.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sctp/associola.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b453e00da1211e997b82743d28af7714c59c05c8",
                    "status": "affected",
                    "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dfea32dd76f390e3155177b0038cc47b01386198",
                    "status": "affected",
                    "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "80f48523a0fe42db2e7375dff4e38a25c117090a",
                    "status": "affected",
                    "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "546221b86ceeba0d8fec92d46a0604bb7b62be07",
                    "status": "affected",
                    "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "09e722030e8148ba4ed1e42c6b2ea57bda9f9895",
                    "status": "affected",
                    "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0",
                    "status": "affected",
                    "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75",
                    "status": "affected",
                    "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bd0e9289e2642f6a5c54faad304ce0f41e926d22",
                    "status": "affected",
                    "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sctp/associola.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.7"
                  },
                  {
                    "lessThan": "4.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: prevent peer transport count overflow\n\nsctp_assoc_add_peer() increments the association\u0027s 16-bit transport_count\nfor every new unique peer. Adding the 65,536th transport wraps the count to\nzero.\n\nSCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,\nthen copies one sockaddr_storage for every entry in transport_addr_list.\nAfter the wrap, a diagnostic dump reserves an empty payload and writes\n8 MiB of peer addresses past the skb tail.\n\nReject a new unique peer when transport_count has reached U16_MAX. Perform\nthe check after the existing-peer lookup so a duplicate address continues\nto return its existing transport at the limit."
          }
        ],
        "id": "CVE-2026-74469",
        "lastModified": "2026-08-19T17:21:03.977",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:17:51.623",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/09e722030e8148ba4ed1e42c6b2ea57bda9f9895"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/546221b86ceeba0d8fec92d46a0604bb7b62be07"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/80f48523a0fe42db2e7375dff4e38a25c117090a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b453e00da1211e997b82743d28af7714c59c05c8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bd0e9289e2642f6a5c54faad304ce0f41e926d22"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dfea32dd76f390e3155177b0038cc47b01386198"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-30T14:45:46+00:00",
      "cve": "CVE-2026-74469",
      "id": "CVE-2026-74469",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:fixed": "1518",
      "product_status:known_affected": "234",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sctp: prevent peer transport count overflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74469.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-19T01:49:45Z",
      "cve": "CVE-2026-74469",
      "id": "CVE-2026-74469",
      "initial_release_date": "2026-08-15T23:52:23Z",
      "product_status:known_affected": "356",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74469",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74469.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.