CVE-2026-74469

sctp: prevent peer transport count overflow

No known exploitation. EPSS puts it in the 50th percentile. No fix published yet.

CVSS 3.18.8High EPSS percentile50th0.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-08-15Updated 2026-08-19Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your linux kernel has SCTP enabled or loaded, and whether untrusted users can obtain local accounts or run workloads on the system.
Install your operating system vendor’s kernel update containing one of these fixes: b453e00da1211e997b82743d28af7714c59c05c8, dfea32dd76f390e3155177b0038cc47b01386198, 80f48523a0fe42db2e7375dff4e38a25c117090a, 546221b86ceeba0d8fec92d46a0604bb7b62be07, 09e722030e8148ba4ed1e42c6b2ea57bda9f9895, 4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0, 6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75, or bd0e9289e2642f6a5c54faad304ce0f41e926d22.
Restart into the updated kernel and confirm the running kernel is the updated vendor release.
If an update must wait, remove unneeded SCTP support and restrict untrusted local accounts and workloads.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, then copies one sockaddr_storage for every entry in transport_addr_list. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail. Reject a new unique peer when transport_count has reached U16_MAX. Perform the check after the existing-peer lookup so a duplicate address continues to return its existing transport at the limit.

In plain language

Written by AI from the record

CVE-2026-74469 is a serious flaw in the linux kernel that a low-privileged local user could use to take over or crash a server, so businesses with shared or untrusted user access should install their vendor’s kernel update promptly.

Local privilege escalation and denial of service in SCTP: peer transport_count can overflow, causing SCTP sock_diag to under-allocate its peer payload and write out of bounds.

If you're affected

Full server takeover
Server crashes
Sensitive data exposure
Business-service disruption

What is it

The linux kernel is the core layer that controls a server’s hardware and basic operations. This flaw can let a local user overfill a networking record and corrupt memory, like making a filing cabinet label say it has no files while someone keeps forcing thousands of files into it until they spill into other cabinets.

Who is affected

This matters to you if you run the linux kernel on servers, workstations, virtual machines, or hosted workloads that use the Stream Control Transmission Protocol (SCTP) networking feature. It is a risk when standard SCTP kernel modules are in use and an attacker can get a low-privileged local account or run a local workload; no user action is needed.

How urgent is it

A low-privileged local attacker can corrupt kernel memory to take control of or crash the system, which makes this a red-priority issue for systems exposed to untrusted users. There are no clear reports of real-world exploitation and no public exploit code, but the impact warrants prompt remediation.

What to do — in detail

Confirm exposure by identifying running linux kernel systems, checking whether SCTP support is enabled or loaded, and determining whether low-privileged users, tenants, containers, or job runners can create SCTP sockets and associations. Update through the operating-system or kernel vendor rather than applying a source commit directly; the supplied patch data identifies eight fixed commits, but does not map them to stable kernel branches, so obtain the vendor release that includes the applicable commit.

After installation, reboot into the new kernel and verify the running release matches the updated package. If upgrading is delayed, disable or unload SCTP where it is not required and limit untrusted local accounts and workloads on affected hosts. No CISA KEV due date applies because this CVE is not listed in KEV. Watch for unexpected kernel crashes and unusually large SCTP peer-association activity while remediation is pending.

Technical context

CVE-2026-74469 is rated CVSS 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while the findings characterize the practical attack vector as local and requiring low privilege. SCTP association peer transport_count is a 16-bit counter; adding 65,536 unique peers wraps it to zero. SCTP sock_diag then reserves too little INET_DIAG_PEERS space and copies peer addresses beyond the skb tail, producing out-of-bounds memory corruption. It is not in CISA KEV, there is no clear dated in-the-wild exploitation claim, and no public exploit code is recorded. EPSS is 0.5% at the 40th percentile with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS50th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.7% chance of exploitation activity in the next 30 days, which ranks it in the 50th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 12 days, from the signal feeds we watch.

2026-08-27OpenVAS check added
2026-08-19Record updated
2026-08-17Record updated
2026-08-15Publishedrecord updated

Affected products

Linuxoss-projectaka the linux kernel
- LinuxOSOn-premOperating Systems / linux-distro

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Sources

References in the record

And 5 more references. See all after sign-in

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Linux, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account