Loading vulnerability…
Linux kernel SCTP peer transport count overflow leading to kernel memory corruption
CVE-2026-74469 is an integer overflow vulnerability in the Linux kernel SCTP implementation. The sctp_assoc_add_peer() function increments an association's 16-bit transport_count for each new unique peer transport without preventing wraparound. Adding the 65,536th unique transport resets the counter to zero while retaining the entries in transport_addr_list. SCTP sock_diag uses this counter to reserve space for the INET_DIAG_PEERS payload, but subsequently copies one sockaddr_storage for every transport-list entry. A diagnostic dump after the wrap therefore reserves an empty payload and writes approximately 8 MiB of peer addresses beyond the socket-buffer tail, corrupting kernel memory.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful triggering causes a large out-of-bounds kernel-memory write, potentially crashing the system and denying service. The corruption may also permit privilege escalation or code execution in kernel context, with consequent confidentiality and integrity compromise; these outcomes are potential consequences rather than demonstrated exploit results. Advisory-wide severity scores and exploit-availability flags covering multiple vulnerabilities do not establish this CVE's individual exploitability.
If you can’t patch tonight, do this now.
No specific vendor workaround is documented. As temporary exposure reduction, disable unneeded SCTP functionality where operationally feasible and restrict untrusted access to interfaces that permit SCTP peer-transport creation or SCTP diagnostic dumps. These measures do not replace the kernel fix.
Patch, then assume compromise.
Install the distribution-supported kernel security update or applicable live patch containing the SCTP transport-count fix. The code correction rejects a new unique peer when transport_count reaches U16_MAX (65,535), checking after the existing-peer lookup so duplicate addresses still return their existing transport. Released SUSE fixed baselines include 5.14.21-150400.24.243.1 for applicable SLE 15 SP4 products, 5.14.21-150500.55.192.2 for applicable SLE 15 SP5 products, 6.4.0-150600.23.138.1 for applicable SLE 15 SP6 products, and 6.4.0-150700.7.78.1 for Real Time 15 SP7. Select updates for the exact product, service pack, architecture, and kernel flavor; versions identified only as QA targets are not generally available fixes. Reboot into the corrected kernel unless using an applicable supported live patch.
1 exploit validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
78 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.