CVE-2026-74469

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer overflow occurs in the SCTP implementation when the sctp assoc add peer() function increments the 16-bit transport count variable for every new unique peer. When the 65,536th transport is added, the count wraps around to zero. Subsequently, SCTP sock diag uses this transport count to reserve the INET DIAG PEERS payload but copies one sockaddr storage for every entry in the transport addr list. This results in a diagnostic dump that reserves an empty payload and writes 8 MiB of peer addresses beyond the skb tail.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.