CVE-2026-74469

Published Aug 15, 2026

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-74469, also known as "DiagSpill," is an integer overflow vulnerability found within the Stream Control Transmission Protocol (SCTP) implementation of the Linux kernel. The flaw specifically resides in the `sctp_assoc_add_peer` function. This function is responsible for incrementing a 16-bit `transport_count` for each new unique peer associated with an SCTP connection. The vulnerability occurs when a local attacker with low privileges manipulates the system to cause the `transport_count` to exceed its 16-bit limit, leading to an integer overflow where the count wraps back to zero. When this happens, the SCTP `sock_diag` diagnostic reporting mechanism reserves an insufficient amount of memory for the `INET_DIAG_PEERS` payload. Consequently, when peer transport data is copied, it results in an out-of-bounds write of approximately 8 MB of data past the allocated socket buffer (skb) tail, leading to memory corruption.

Description: In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, then copies one sockaddr_storage for every entry in transport_addr_list. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail. Reject a new unique peer when transport_count has reached U16_MAX. Perform the check after the existing-peer lookup so a duplicate address continues to return its existing transport at the limit.
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 13

References

Sources include official advisories and independent security research.

Overview

AI description

Risk scores

CVSS 3.1

Social media

References