In the Linux kernel

CVE-2026-74469 is a 16-bit integer wrap in the Linux kernel's SCTP subsystem. The function sctp_assoc_add_peer() increments a u16 transport_count for each unique peer address added to an association. When the 65,536th peer wraps the counter to zero, any subsequent NETLINK_SOCK_DIAG query (e.g. ss -S, or a monitoring daemon) allocates a zero-length payload buffer but then copies one sockaddr_storage per entry in the real transport list — writing roughly 8 MiB past the skb tail into kernel heap. The bug was introduced in commit 8f840e47 (kernel 4.7, July 2016) and fixed in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. Affected distros include Ubuntu 24.04/22.04/20.04/18.04 LTS and RHEL/Rocky 8/9.

The vendor CVSS of 8.8 HIGH overstates real-world risk by at least two full points. The score assumes AV:N/AC:L, but ignores three compounding friction layers: (1) SCTP is a niche telecom protocol whose kernel module is not loaded by default on any major distro, (2) the attacker must inject 65,536 unique peer addresses into a single association — either via INIT address parameters or ASCONF ADD_IP chunks (the latter requires net.sctp.addip_enable=1, which defaults to OFF) — and (3) the actual heap overflow is not triggered by the network traffic itself but by a *separate* local NETLINK_SOCK_DIAG request, making this a two-stage attack. Ubuntu's own triage rated this Medium priority, which aligns with a realistic assessment.

Why this verdict

• SCTP is not loaded by default — the sctp kernel module must be explicitly loaded or pulled in by a telecom application. On a fleet of 10,000 general-purpose Linux hosts, fewer than 500 are likely to have SCTP active, and most of those are on isolated signaling VLANs.
• 65,536-peer barrier is enormous — the attacker must sustain a single SCTP association while injecting 65K unique transport addresses. This is orders of magnitude beyond normal SCTP usage, consumes hundreds of MB of kernel memory, and would trigger OOM or monitoring alerts long before the wrap. ASCONF ADD_IP (the easier injection vector) requires a sysctl that defaults to OFF.
• Two-stage attack negates AV:N simplicity — the network traffic alone does not trigger the overflow. A separate local NETLINK_SOCK_DIAG query must occur while the wrapped association is alive. This is not a single-packet remote exploit; it requires either local access or reliance on a monitoring daemon's polling interval.
• Role multiplier: SCTP deployments are concentrated in telecom infrastructure (mobile core, IMS, Diameter, SIGTRAN) which qualifies as high-value / OT-adjacent. If the chain succeeds on a telecom signaling node, the blast radius is service disruption to mobile subscribers. However, the 65K-peer prerequisite remains a hard practical barrier even in telecom, and these environments have dedicated security monitoring. The high-value-role floor for MEDIUM is satisfied but does not push to HIGH because the chain's practical feasibility is too low even in the worst-case role.
• No PoC, no KEV, bottom-quartile EPSS — zero evidence of real-world exploitation or weaponization interest. The complexity of the trigger chain explains why.

Why not higher?

Upgrading to HIGH would require either active exploitation evidence, a credible PoC, or a realistic single-stage remote attack path. None of these exist. The 65K-peer prerequisite is not a theoretical limit — it is a hard practical barrier that requires sustained, noisy interaction with a niche protocol. Even in telecom (the worst-case role), the attack would be detected and the association killed long before reaching the wrap threshold.

Why not lower?

Downgrading to LOW would undercount the severity of the *impact* when the chain completes: an 8 MiB kernel heap overwrite is a guaranteed kernel panic and a plausible (if difficult) code execution primitive. The 10-year affected window means unpatched kernels will linger in LTS distros. And while SCTP is niche, it is not extinct — telecom and 5G CNF environments do run it in production, and a kernel crash on a signaling node has real operational impact.

1. Unload the sctp kernel module where not needed — Run modprobe -r sctp and blacklist it via /etc/modprobe.d/blacklist-sctp.conf containing install sctp /bin/false. This eliminates the attack surface entirely on hosts that don't use SCTP. Verify across your fleet within the 365-day noisgate remediation SLA window, but prioritize this as a quick win.
2. Set net.sctp.addip_enable=0 (confirm default) — Ensure sysctl net.sctp.addip_enable=0 is enforced via /etc/sysctl.d/. This blocks ASCONF ADD_IP chunks, which is the most practical vector for injecting large numbers of peer addresses. This should already be the default but verify explicitly on SCTP-enabled hosts.
3. Firewall SCTP at the perimeter — Block IP protocol 132 (SCTP) at perimeter firewalls and host-based firewalls (iptables/nftables) unless explicitly required. Most enterprise firewall rulesets already omit SCTP, but audit for gaps. On hosts where SCTP is required, restrict source IPs to known signaling peers.
4. Monitor SCTP association transport counts — On hosts that legitimately run SCTP, add monitoring for abnormal transport counts per association. Any association with >1,000 transports is anomalous and should trigger an alert. Use ss -S output or custom netlink monitoring.

Run this script on each target Linux host as root (needs access to /proc/config.gz and modprobe state). Invoke with: sudo bash check_cve_2026_74469.sh. No arguments required.

#!/bin/bash
# CVE-2026-74469 checker — SCTP transport_count overflow
# Run as root on target Linux host
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

RESULT="UNKNOWN"
KERNEL=$(uname -r)

# Check if SCTP module is loaded or built-in
SCTP_LOADED=0
if lsmod 2>/dev/null | grep -q '^sctp '; then
  SCTP_LOADED=1
elif [ -f /proc/config.gz ]; then
  if zcat /proc/config.gz 2>/dev/null | grep -q 'CONFIG_IP_SCTP=y'; then
    SCTP_LOADED=1
  fi
elif [ -f "/boot/config-${KERNEL}" ]; then
  if grep -q 'CONFIG_IP_SCTP=y' "/boot/config-${KERNEL}" 2>/dev/null; then
    SCTP_LOADED=1
  fi
fi

if [ "$SCTP_LOADED" -eq 0 ]; then
  # Check if module is available but not loaded
  if modinfo sctp &>/dev/null; then
    echo "INFO: SCTP module available but not loaded — attack surface not currently active"
    echo "INFO: Module could be loaded by any process creating an SCTP socket"
  else
    echo "PATCHED — SCTP module not available in this kernel build"
    exit 0
  fi
fi

# Check for the fix commit by looking for the U16_MAX check in sctp_assoc_add_peer
# The fix adds a transport_count >= U16_MAX check
FIX_COMMIT="bd0e928"

# Version-based check against known-fixed kernels
PATCHED_VERSIONS=(
  "6.6.151" "6.12.103" "6.18.44" "7.1.8"
)

version_gte() {
  printf '%s\n%s' "$2" "$1" | sort -V -C
}

# Extract base version (strip distro suffix)
BASE_VER=$(echo "$KERNEL" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')
MAJOR_MINOR=$(echo "$KERNEL" | grep -oP '^[0-9]+\.[0-9]+')

case "$MAJOR_MINOR" in
  6.6)  version_gte "$BASE_VER" "6.6.151"  && RESULT="PATCHED" || RESULT="VULNERABLE" ;;
  6.12) version_gte "$BASE_VER" "6.12.103" && RESULT="PATCHED" || RESULT="VULNERABLE" ;;
  6.18) version_gte "$BASE_VER" "6.18.44"  && RESULT="PATCHED" || RESULT="VULNERABLE" ;;
  7.1)  version_gte "$BASE_VER" "7.1.8"    && RESULT="PATCHED" || RESULT="VULNERABLE" ;;
  7.2)  RESULT="PATCHED" ;;
  *)
    # For distro kernels (e.g., 5.15.x-ubuntu, 5.14.x-el9), check distro changelogs
    if [ -f /var/log/dpkg.log ] || command -v dpkg &>/dev/null; then
      if dpkg-query -W -f='${Version}' linux-image-"$KERNEL" 2>/dev/null | grep -q .; then
        echo "INFO: Distro kernel detected — check Ubuntu/Debian security tracker for backport status"
      fi
    elif command -v rpm &>/dev/null; then
      RPM_VER=$(rpm -q kernel-"$KERNEL" 2>/dev/null || rpm -q kernel-core-"$KERNEL" 2>/dev/null || true)
      if [ -n "$RPM_VER" ]; then
        echo "INFO: RHEL/Rocky kernel detected — check distro errata for backport of commit $FIX_COMMIT"
      fi
    fi
    # Kernels older than 4.7 are not affected
    if version_gte "4.7.0" "$BASE_VER" 2>/dev/null; then
      RESULT="PATCHED"
      echo "INFO: Kernel $BASE_VER predates the vulnerable commit (4.7+)"
    else
      RESULT="UNKNOWN"
    fi
    ;;
esac

echo "Kernel: $KERNEL"
echo "SCTP loaded/built-in: $SCTP_LOADED"
echo "Result: $RESULT"

case "$RESULT" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac

Sources

1. Ubuntu Security Tracker — CVE-2026-74469
2. OpenCVE — CVE-2026-74469 Details
3. Strix AI — CVE-2026-74469 Analysis
4. OSV — CVE-2026-74469
5. CyberStrike — CVE-2026-74469 Detail
6. Ratatoskr — linux-cve-announce CVE-2026-74469
7. CIQ Kernel Patch PR (RHEL 9)
8. Linux man7 — sctp(7) manual page