{"id":"CVE-2026-74469","summary":"sctp: prevent peer transport count overflow","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: prevent peer transport count overflow\n\nsctp_assoc_add_peer() increments the association's 16-bit transport_count\nfor every new unique peer. Adding the 65,536th transport wraps the count to\nzero.\n\nSCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,\nthen copies one sockaddr_storage for every entry in transport_addr_list.\nAfter the wrap, a diagnostic dump reserves an empty payload and writes\n8 MiB of peer addresses past the skb tail.\n\nReject a new unique peer when transport_count has reached U16_MAX. Perform\nthe check after the existing-peer lookup so a duplicate address continues\nto return its existing transport at the limit.","modified":"2026-08-21T03:30:37.932025061Z","published":"2026-08-15T12:27:06.873Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74469.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/09e722030e8148ba4ed1e42c6b2ea57bda9f9895"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/546221b86ceeba0d8fec92d46a0604bb7b62be07"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75"},{"type":"WEB","url":"https://git.kernel.org/stable/c/80f48523a0fe42db2e7375dff4e38a25c117090a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b453e00da1211e997b82743d28af7714c59c05c8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/bd0e9289e2642f6a5c54faad304ce0f41e926d22"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dfea32dd76f390e3155177b0038cc47b01386198"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74469.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74469"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"8f840e47f190cbe61a96945c13e9551048d42cef"},{"fixed":"b453e00da1211e997b82743d28af7714c59c05c8"},{"fixed":"dfea32dd76f390e3155177b0038cc47b01386198"},{"fixed":"80f48523a0fe42db2e7375dff4e38a25c117090a"},{"fixed":"546221b86ceeba0d8fec92d46a0604bb7b62be07"},{"fixed":"09e722030e8148ba4ed1e42c6b2ea57bda9f9895"},{"fixed":"4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0"},{"fixed":"6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75"},{"fixed":"bd0e9289e2642f6a5c54faad304ce0f41e926d22"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74469.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"5.10.265"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.216"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.183"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.151"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.103"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.44"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.8"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74469.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}