CVE-2026-74469

sctp: prevent peer transport count overflow

State: Published
Severity: 8.8 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: prevent peer transport count overflow

sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count to zero.

SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, then copies one sockaddr_storage for every entry in transport_addr_list. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail.

Reject a new unique peer when transport_count has reached U16_MAX. Perform the check after the existing-peer lookup so a duplicate address continues to return its existing transport at the limit.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8f840e47f190cbe61a96945c13e9551048d42cef to before b453e00da1211e997b82743d28af7714c59c05c8Affected 8f840e47f190cbe61a96945c13e9551048d42cef to before dfea32dd76f390e3155177b0038cc47b01386198Affected 8f840e47f190cbe61a96945c13e9551048d42cef to before 80f48523a0fe42db2e7375dff4e38a25c117090aAffected 8f840e47f190cbe61a96945c13e9551048d42cef to before 546221b86ceeba0d8fec92d46a0604bb7b62be07Affected 8f840e47f190cbe61a96945c13e9551048d42cef to before 09e722030e8148ba4ed1e42c6b2ea57bda9f9895Affected 8f840e47f190cbe61a96945c13e9551048d42cef to before 4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0Affected 8f840e47f190cbe61a96945c13e9551048d42cef to before 6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75Affected 8f840e47f190cbe61a96945c13e9551048d42cef to before bd0e9289e2642f6a5c54faad304ce0f41e926d22Affected
LinuxLinux	4.7Affected before 4.7Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.151 through 6.6.Not affected 6.12.103 through 6.12.Not affected 6.18.44 through 6.18.Not affected 7.1.8 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

8f840e47f190cbe61a96945c13e9551048d42cef to before b453e00da1211e997b82743d28af7714c59c05c8Affected
8f840e47f190cbe61a96945c13e9551048d42cef to before dfea32dd76f390e3155177b0038cc47b01386198Affected
8f840e47f190cbe61a96945c13e9551048d42cef to before 80f48523a0fe42db2e7375dff4e38a25c117090aAffected
8f840e47f190cbe61a96945c13e9551048d42cef to before 546221b86ceeba0d8fec92d46a0604bb7b62be07Affected
8f840e47f190cbe61a96945c13e9551048d42cef to before 09e722030e8148ba4ed1e42c6b2ea57bda9f9895Affected
8f840e47f190cbe61a96945c13e9551048d42cef to before 4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0Affected
8f840e47f190cbe61a96945c13e9551048d42cef to before 6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75Affected
8f840e47f190cbe61a96945c13e9551048d42cef to before bd0e9289e2642f6a5c54faad304ce0f41e926d22Affected

LinuxLinux

4.7Affected
before 4.7Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.151 through 6.6.*Not affected
6.12.103 through 6.12.*Not affected
6.18.44 through 6.18.*Not affected
7.1.8 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.