Out-of-bounds write in Linux kernel - CVE-2026-74469

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in SCTP sock_diag when processing a diagnostic dump after adding many unique peer transports. A local user can add unique peer addresses until the 16-bit transport_count wraps and trigger a diagnostic dump to cause a denial of service.

The issue occurs when the association accumulates 65,536 unique peer transports, causing transport_count to wrap to zero while peer addresses are still copied from transport_addr_list.

Affected software

How to mitigate CVE-2026-74469

External References

• https://git.kernel.org/stable/c/09e722030e8148ba4ed1e42c6b2ea57bda9f9895
• https://git.kernel.org/stable/c/4ba5bf7ed50f235ea4581de8e7a0002f4ed287b0
• https://git.kernel.org/stable/c/546221b86ceeba0d8fec92d46a0604bb7b62be07
• https://git.kernel.org/stable/c/6201cd1d70f1670c5b31ac506e7ab2fa7b8e7f75
• https://git.kernel.org/stable/c/bd0e9289e2642f6a5c54faad304ce0f41e926d22

Related Security Bulletins

• Out-of-bounds write in Linux kernel sctp
• Debian update for linux