---
id: CVE-2026-74469
title: 'sctp: prevent peer transport count overflow'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sctp: prevent peer transport count overflow

  sctp_assoc_add_peer() increments the association's 16-bit transport_count
  for every new unique peer. Adding the 65,536th tr…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef <
    b453e00da1211e997b82743d28af7714c59c05c8
  - >-
    Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef <
    dfea32dd76f390e3155177b0038cc47b01386198
  - >-
    Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef <
    80f48523a0fe42db2e7375dff4e38a25c117090a
  - >-
    Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef <
    546221b86ceeba0d8fec92d46a0604bb7b62be07
  - >-
    Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef <
    09e722030e8148ba4ed1e42c6b2ea57bda9f9895
  - >-
    Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef <
    4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0
  - >-
    Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef <
    6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75
  - >-
    Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef <
    bd0e9289e2642f6a5c54faad304ce0f41e926d22
  - Linux 4.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:57:13.238914Z'
exploitAvailable: true
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:47.493Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74469'
references:
  - url: 'https://git.kernel.org/stable/c/b453e00da1211e997b82743d28af7714c59c05c8'
  - url: 'https://git.kernel.org/stable/c/dfea32dd76f390e3155177b0038cc47b01386198'
  - url: 'https://git.kernel.org/stable/c/80f48523a0fe42db2e7375dff4e38a25c117090a'
  - url: 'https://git.kernel.org/stable/c/546221b86ceeba0d8fec92d46a0604bb7b62be07'
  - url: 'https://git.kernel.org/stable/c/09e722030e8148ba4ed1e42c6b2ea57bda9f9895'
  - url: 'https://git.kernel.org/stable/c/4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0'
  - url: 'https://git.kernel.org/stable/c/6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75'
  - url: 'https://git.kernel.org/stable/c/bd0e9289e2642f6a5c54faad304ce0f41e926d22'
tags:
  - cve.org
  - exploit-available
epss: 0.01467
epssPercentile: 0.73258
exploits:
  github: 3
  githubRepos:
    - 'https://github.com/suominen/diagspill'
    - 'https://github.com/0xBlackash/CVE-2026-74469'
    - 'https://github.com/HORKimhab/CVE-2026-74469'
  checkedAt: '2026-10-16T19:46:58.899Z'
ingestedAt: '2026-10-16T19:46:24.359Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sctp: prevent peer transport count overflow

sctp_assoc_add_peer() increments the association's 16-bit transport_count
for every new unique peer. Adding the 65,536th transport wraps the count to
zero.

SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,
then copies one sockaddr_storage for every entry in transport_addr_list.
After the wrap, a diagnostic dump reserves an empty payload and writes
8 MiB of peer addresses past the skb tail.

Reject a new unique peer when transport_count has reached U16_MAX. Perform
the check after the existing-peer lookup so a duplicate address continues
to return its existing transport at the limit.

## Affected

- `Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef < b453e00da1211e997b82743d28af7714c59c05c8`
- `Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef < dfea32dd76f390e3155177b0038cc47b01386198`
- `Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef < 80f48523a0fe42db2e7375dff4e38a25c117090a`
- `Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef < 546221b86ceeba0d8fec92d46a0604bb7b62be07`
- `Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef < 09e722030e8148ba4ed1e42c6b2ea57bda9f9895`
- `Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef < 4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0`
- `Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef < 6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75`
- `Linux >= 8f840e47f190cbe61a96945c13e9551048d42cef < bd0e9289e2642f6a5c54faad304ce0f41e926d22`
- `Linux 4.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.