HIGH Public exploit Introduced in 4.7
DiagSpill
CVE-2026-74469
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, then copies one sockaddr_storage for every entry in transport_addr_list. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail. Reject a new unique peer when transport_count has reached U16_MAX. Perform the check after the existing-peer lookup so a duplicate address continues to return its existing transport at the limit.
02KernelScan AI Analysis
Risk summary
A local unprivileged user can overflow a 16-bit peer transport counter in an SCTP association, causing a subsequent diagnostic dump to write approximately 8 MiB of peer address data past the end of a kernel buffer. This results in kernel heap corruption that can lead to arbitrary read/write capability or a system crash. A remote SCTP peer can also set up the overflow condition on a server that accepts SCTP connections, though triggering the actual memory corruption still requires a local diagnostic query.
Vulnerability analysis
The SCTP association handling increments a 16-bit counter each time a new peer transport address is added, without checking for overflow. When the counter wraps to zero on the 65,536th addition, a subsequent diagnostic dump via the NETLINK socket interface reserves buffer space based on the wrapped (zero) count but then copies all stored peer addresses into the undersized buffer, writing approximately 8 MiB past the buffer boundary. The fix rejects new peer additions once the counter reaches its maximum value, preventing the wrap from ever occurring. The overflow can be set up by any local user with an SCTP socket or by a remote SCTP peer supplying many addresses during association establishment on a server that accepts SCTP connections; the resulting out-of-bounds write is triggered when a local diagnostic dump is performed, which any local user can initiate via NETLINK.
Exploit availability
KernelScan found public exploit code for this CVE. Open it in the CVE browser to see what we found, where, and how strong the evidence is — that needs a free account with a confirmed email address.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.7 | 5.10.265 | b453e00da121 |
| 5.15 | 4.7 | 5.15.216 | dfea32dd76f3 |
| 6.1 | 4.7 | 6.1.183 | 80f48523a0fe |
| 6.12 | 4.7 | 6.12.103 | 09e722030e81 |
| 6.18 | 4.7 | 6.18.44 | 4ba5bf7ed50f |
| 6.6 | 4.7 | 6.6.151 | 546221b86cee |
| 7.1 | 4.7 | 7.1.8 | 6201cd1d70f1 |
| mainline | 4.7 | 7.2 | bd0e9289e264 |
| cip/4.19 | 4.7 | 4.19.325-cip136 | 1c5b2e8c6927 |
| cip/4.19-rt | 4.7 | 4.19.325-cip136-rt50 | 1c5b2e8c6927 |
| cip/4.4 | 4.7 | 4.4.302-cip115 | c9a552867aca |
| cip/4.4-rt | 4.7 | 4.4.302-cip115-rt63 | c9a552867aca |
| cip/5.10 | 4.7 | 5.10.268-cip77 | b453e00da121 |
| cip/5.10-rt | 4.7 | 5.10.268-cip77-rt34 | b453e00da121 |
| cip/6.1 | 4.7 | 6.1.187-cip60 | 80f48523a0fe |
| cip/6.1-rt | 4.7 | 6.1.189-cip61-rt32 | 80f48523a0fe |
| cip/6.12 | 4.7 | 6.12.104-cip30 | 09e722030e81 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.104-cip30 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |
| cip/4.19 | Fixed in 4.19.325-cip136 |
| cip/4.19-rt | Fixed in 4.19.325-cip136-rt50 |
| cip/4.4 | Fixed in 4.4.302-cip115 |
| cip/4.4-rt | Fixed in 4.4.302-cip115-rt63 |