CVE-2026-74469: sctp: prevent peer transport count overflow
In the Linux kernel, the following vulnerability has been resolved:
sctp: prevent peer transport count overflow
sctpassocaddpeer() increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero.
SCTP sockdiag uses transportcount to reserve the INETDIAGPEERS payload, then copies one sockaddrstorage for every entry in transportaddrlist. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail.
Reject a new unique peer when transportcount has reached U16MAX. Perform the check after the existing-peer lookup so a duplicate address continues to return its existing transport at the limit.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74469?
CVE-2026-74469 has a risk severity rating of 50.
What issue does CVE-2026-74469 address?
CVE-2026-74469 addresses a vulnerability in the Linux kernel related to SCTP where the transport count can overflow.
How do I fix CVE-2026-74469?
To fix CVE-2026-74469, it is recommended to update to the latest patched version of the Linux kernel.
What component is affected by CVE-2026-74469?
CVE-2026-74469 affects the SCTP (Stream Control Transmission Protocol) implementation in the Linux kernel.
When was CVE-2026-74469 published?
CVE-2026-74469 was published on August 15, 2026.