Out-of-bounds write in Linux kernel - CVE-2026-74469

Vulnerability identifier: #VU143314

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-74469

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in SCTP sock_diag when processing a diagnostic dump after adding many unique peer transports. A local user can add unique peer addresses until the 16-bit transport_count wraps and trigger a diagnostic dump to cause a denial of service.

The issue occurs when the association accumulates 65,536 unique peer transports, causing transport_count to wrap to zero while peer addresses are still copied from transport_addr_list.

Linux kernel
Debian Linux
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
kernel (Red Hat package)
kernel-rt (Red Hat package)
linux (Debian package)
Red Hat OpenShift Container Platform

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel (Red Hat package) - addressed in versions 3.10.0-1160.164.1.el7, 4.18.0-305.209.1.el8_4, 4.18.0-372.218.1.el8_6, 4.18.0-477.170.1.el8_8, 5.14.0-284.194.1.el9_2, 6.12.0-55.107.1.el10_0, 6.12.0-259.27.el10nv
kernel-rt (Red Hat package) - addressed in versions 3.10.0-1160.164.1.rt56.1316.el7, 5.14.0-284.194.1.rt14.479.el9_2
Red Hat OpenShift Container Platform - addressed in versions 4.19.50, 4.20.41, 4.21.36
linux (Debian package) - update to 6.12.105-1

• https://git.kernel.org/stable/c/09e722030e8148ba4ed1e42c6b2ea57bda9f9895
• https://git.kernel.org/stable/c/4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0
• https://git.kernel.org/stable/c/546221b86ceeba0d8fec92d46a0604bb7b62be07
• https://git.kernel.org/stable/c/6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75
• https://git.kernel.org/stable/c/bd0e9289e2642f6a5c54faad304ce0f41e926d22

• Out-of-bounds write in Linux kernel sctp
• Debian update for linux
• Red Hat Enterprise Linux 8 update for kernel
• Red Hat Enterprise Linux 8 update for kernel
• Red Hat Enterprise Linux 8 update for kernel
• Red Hat Enterprise Linux 9 update for kernel-rt
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for kernel-rt
• Red Hat Enterprise Linux 10 update for kernel
• Red Hat Enterprise Linux 9 update for kernel
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for kernel
• Red Hat Enterprise Linux for NVIDIA update for kernel
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.20
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.21