{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74469", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.902Z", "datePublished": "2026-08-15T12:27:06.873Z", "dateUpdated": "2026-08-19T16:37:15.198Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:37:15.198Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: prevent peer transport count overflow\n\nsctp_assoc_add_peer() increments the association's 16-bit transport_count\nfor every new unique peer. Adding the 65,536th transport wraps the count to\nzero.\n\nSCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,\nthen copies one sockaddr_storage for every entry in transport_addr_list.\nAfter the wrap, a diagnostic dump reserves an empty payload and writes\n8 MiB of peer addresses past the skb tail.\n\nReject a new unique peer when transport_count has reached U16_MAX. Perform\nthe check after the existing-peer lookup so a duplicate address continues\nto return its existing transport at the limit."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - Remote SCTP peers add unique transports via INIT address parameters and ASCONF ADD_IP chunks processed in sctp_assoc_add_peer(); this is network ingress on SCTP servers (telecom, signaling gateways) before any local diagnostic action.\nAC:L - An attacker controlling an SCTP association can script 65536 unique peer addresses via connectx, repeated ASCONF ADD_IP, or INIT parameters; no race or victim-specific state is required beyond reaching the transport limit.\nPR:L - The heap overflow is triggered via NETLINK_SOCK_DIAG (ss/netlink), reachable by unprivileged users; SCTP socket creation and connectx need no capabilities beyond a normal local account (including user namespaces).\nUI:N - Exploitation requires no victim interaction; the attacker drives transport accumulation and issues the diagnostic dump themselves.\nS:U - Impact is kernel heap corruption within the same kernel security boundary; this is not a VM escape, sandbox breakout, or cross-authority scope change.\nC:H - When transport_count wraps to zero, inet_diag_msg_sctpaddrs_fill() reserves no space but iterates all 65536 transports, writing ~8 MiB past the skb tail and enabling adjacent kernel heap reads.\nI:H - The same diag path performs a massive out-of-bounds write of sockaddr_storage entries past the allocated skb buffer, corrupting adjacent kernel heap objects and enabling control-flow hijacking.\nA:H - Corrupting sk_buff heap metadata and adjacent allocations via an ~8 MiB out-of-bounds write can cause kernel oops, panic, or hang, meeting high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sctp/associola.c"], "versions": [{"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "b453e00da1211e997b82743d28af7714c59c05c8", "status": "affected", "versionType": "git"}, {"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "dfea32dd76f390e3155177b0038cc47b01386198", "status": "affected", "versionType": "git"}, {"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "80f48523a0fe42db2e7375dff4e38a25c117090a", "status": "affected", "versionType": "git"}, {"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "546221b86ceeba0d8fec92d46a0604bb7b62be07", "status": "affected", "versionType": "git"}, {"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "09e722030e8148ba4ed1e42c6b2ea57bda9f9895", "status": "affected", "versionType": "git"}, {"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0", "status": "affected", "versionType": "git"}, {"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75", "status": "affected", "versionType": "git"}, {"version": "8f840e47f190cbe61a96945c13e9551048d42cef", "lessThan": "bd0e9289e2642f6a5c54faad304ce0f41e926d22", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sctp/associola.c"], "versions": [{"version": "4.7", "status": "affected"}, {"version": "0", "lessThan": "4.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b453e00da1211e997b82743d28af7714c59c05c8"}, {"url": "https://git.kernel.org/stable/c/dfea32dd76f390e3155177b0038cc47b01386198"}, {"url": "https://git.kernel.org/stable/c/80f48523a0fe42db2e7375dff4e38a25c117090a"}, {"url": "https://git.kernel.org/stable/c/546221b86ceeba0d8fec92d46a0604bb7b62be07"}, {"url": "https://git.kernel.org/stable/c/09e722030e8148ba4ed1e42c6b2ea57bda9f9895"}, {"url": "https://git.kernel.org/stable/c/4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0"}, {"url": "https://git.kernel.org/stable/c/6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75"}, {"url": "https://git.kernel.org/stable/c/bd0e9289e2642f6a5c54faad304ce0f41e926d22"}], "title": "sctp: prevent peer transport count overflow", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sctp/associola.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b453e00da1211e997b82743d28af7714c59c05c8", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}, {"lessThan": "dfea32dd76f390e3155177b0038cc47b01386198", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}, {"lessThan": "80f48523a0fe42db2e7375dff4e38a25c117090a", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}, {"lessThan": "546221b86ceeba0d8fec92d46a0604bb7b62be07", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}, {"lessThan": "09e722030e8148ba4ed1e42c6b2ea57bda9f9895", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}, {"lessThan": "4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}, {"lessThan": "6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}, {"lessThan": "bd0e9289e2642f6a5c54faad304ce0f41e926d22", "status": "affected", "version": "8f840e47f190cbe61a96945c13e9551048d42cef", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sctp/associola.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.7"}, {"lessThan": "4.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: prevent peer transport count overflow\n\nsctp_assoc_add_peer() increments the association's 16-bit transport_count\nfor every new unique peer. Adding the 65,536th transport wraps the count to\nzero.\n\nSCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,\nthen copies one sockaddr_storage for every entry in transport_addr_list.\nAfter the wrap, a diagnostic dump reserves an empty payload and writes\n8 MiB of peer addresses past the skb tail.\n\nReject a new unique peer when transport_count has reached U16_MAX. Perform\nthe check after the existing-peer lookup so a duplicate address continues\nto return its existing transport at the limit."}], "id": "CVE-2026-74469", "lastModified": "2026-08-19T17:21:03.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T13:17:51.623", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/09e722030e8148ba4ed1e42c6b2ea57bda9f9895"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/546221b86ceeba0d8fec92d46a0604bb7b62be07"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/80f48523a0fe42db2e7375dff4e38a25c117090a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b453e00da1211e997b82743d28af7714c59c05c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bd0e9289e2642f6a5c54faad304ce0f41e926d22"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dfea32dd76f390e3155177b0038cc47b01386198"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: sctp: prevent peer transport count overflow", "id": "2517043", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517043"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsctp: prevent peer transport count overflow\nsctp_assoc_add_peer() increments the association's 16-bit transport_count\nfor every new unique peer. Adding the 65,536th transport wraps the count to\nzero.\nSCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,\nthen copies one sockaddr_storage for every entry in transport_addr_list.\nAfter the wrap, a diagnostic dump reserves an empty payload and writes\n8 MiB of peer addresses past the skb tail.\nReject a new unique peer when transport_count has reached U16_MAX. Perform\nthe check after the existing-peer lookup so a duplicate address continues\nto return its existing transport at the limit.", "A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. An integer overflow occurs when the `transport_count` for an association exceeds its 16-bit limit, causing it to wrap around to zero. This allows a diagnostic dump to write 8 MiB of peer addresses beyond the intended memory buffer, leading to an out-of-bounds write. This memory corruption can result in a denial of service (DoS) due to system instability or crashes."], "name": "CVE-2026-74469", "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74469\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74469\nhttps://lore.kernel.org/linux-cve-announce/2026081534-CVE-2026-74469-d3f3@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f840e47f190cbe61a96945c13e9551048d42cef,546221b86ceeba0d8fec92d46a0604bb7b62be07)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f840e47f190cbe61a96945c13e9551048d42cef,09e722030e8148ba4ed1e42c6b2ea57bda9f9895)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f840e47f190cbe61a96945c13e9551048d42cef,4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f840e47f190cbe61a96945c13e9551048d42cef,6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f840e47f190cbe61a96945c13e9551048d42cef,bd0e9289e2642f6a5c54faad304ce0f41e926d22)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.151,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.103,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T14:15:03.647205+00:00", "updated": "2026-08-21T21:30:17.766586+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-119", "CWE-787"]}