Linux kernel SCTP peer transport 16-bit counter overflow leading to OOB write in sctp_diag (DiagSpill)

#!/bin/bash
# diagspill_check.sh — CVE-2026-74469 (DiagSpill) detection
# Checks: (1) kernel version against fixed releases, (2) SCTP module status
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

RESULT="UNKNOWN"
KVER=$(uname -r)
KMAJOR=$(echo "$KVER" | cut -d. -f1)
KMINOR=$(echo "$KVER" | cut -d. -f2)
KPATCH=$(echo "$KVER" | cut -d. -f3 | cut -d- -f1)

echo "[*] CVE-2026-74469 (DiagSpill) check"
echo "[*] Running kernel: $KVER"

# Fixed versions: 5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2+
version_gte() {
  # Returns 0 if $1.$2.$3 >= $4.$5.$6
  local a1=$1 a2=$2 a3=$3 b1=$4 b2=$5 b3=$6
  if [ "$a1" -gt "$b1" ] 2>/dev/null; then return 0; fi
  if [ "$a1" -lt "$b1" ] 2>/dev/null; then return 1; fi
  if [ "$a2" -gt "$b2" ] 2>/dev/null; then return 0; fi
  if [ "$a2" -lt "$b2" ] 2>/dev/null; then return 1; fi
  if [ "$a3" -ge "$b3" ] 2>/dev/null; then return 0; fi
  return 1
}

check_version() {
  # Kernel < 4.7 is not affected (bug introduced in 4.7)
  if [ "$KMAJOR" -lt 4 ] 2>/dev/null; then
    echo "[+] Kernel predates vulnerable code (introduced in 4.7)"
    RESULT="PATCHED"; return
  fi
  if [ "$KMAJOR" -eq 4 ] && [ "$KMINOR" -lt 7 ] 2>/dev/null; then
    echo "[+] Kernel predates vulnerable code (introduced in 4.7)"
    RESULT="PATCHED"; return
  fi

  # Check against fixed stable branches
  if [ "$KMAJOR" -eq 5 ] && [ "$KMINOR" -eq 10 ]; then
    if version_gte $KMAJOR $KMINOR $KPATCH 5 10 265; then
      RESULT="PATCHED"; echo "[+] Fixed in 5.10.265, running $KVER"; return
    fi
  elif [ "$KMAJOR" -eq 5 ] && [ "$KMINOR" -eq 15 ]; then
    if version_gte $KMAJOR $KMINOR $KPATCH 5 15 216; then
      RESULT="PATCHED"; echo "[+] Fixed in 5.15.216, running $KVER"; return
    fi
  elif [ "$KMAJOR" -eq 6 ] && [ "$KMINOR" -eq 1 ]; then
    if version_gte $KMAJOR $KMINOR $KPATCH 6 1 183; then
      RESULT="PATCHED"; echo "[+] Fixed in 6.1.183, running $KVER"; return
    fi
  elif [ "$KMAJOR" -eq 6 ] && [ "$KMINOR" -eq 6 ]; then
    if version_gte $KMAJOR $KMINOR $KPATCH 6 6 151; then
      RESULT="PATCHED"; echo "[+] Fixed in 6.6.151, running $KVER"; return
    fi
  elif [ "$KMAJOR" -eq 6 ] && [ "$KMINOR" -eq 12 ]; then
    if version_gte $KMAJOR $KMINOR $KPATCH 6 12 103; then
      RESULT="PATCHED"; echo "[+] Fixed in 6.12.103, running $KVER"; return
    fi
  elif [ "$KMAJOR" -eq 6 ] && [ "$KMINOR" -eq 18 ]; then
    if version_gte $KMAJOR $KMINOR $KPATCH 6 18 44; then
      RESULT="PATCHED"; echo "[+] Fixed in 6.18.44, running $KVER"; return
    fi
  elif [ "$KMAJOR" -eq 7 ] && [ "$KMINOR" -eq 1 ]; then
    if version_gte $KMAJOR $KMINOR $KPATCH 7 1 8; then
      RESULT="PATCHED"; echo "[+] Fixed in 7.1.8, running $KVER"; return
    fi
  elif [ "$KMAJOR" -ge 8 ] 2>/dev/null; then
    RESULT="PATCHED"; echo "[+] Kernel $KVER is newer than all affected branches"; return
  elif [ "$KMAJOR" -eq 7 ] && [ "$KMINOR" -ge 2 ] 2>/dev/null; then
    RESULT="PATCHED"; echo "[+] Kernel $KVER is >= 7.2 (fixed in 7.2-rc6)"; return
  fi

  # If we're in an affected major.minor but below the fix
  RESULT="VULNERABLE"
  echo "[-] Kernel $KVER appears VULNERABLE (below fix for this branch)"
}

check_version

# Check SCTP module status
echo ""
echo "[*] SCTP module status:"
if lsmod 2>/dev/null | grep -q '^sctp '; then
  echo "[-] sctp module is LOADED — attack surface is active"
elif modprobe -n sctp 2>/dev/null; then
  echo "[!] sctp module is NOT loaded but CAN be auto-loaded"
else
  echo "[+] sctp module is BLOCKED or unavailable — attack surface eliminated"
  if [ "$RESULT" = "VULNERABLE" ]; then
    echo "[*] Kernel is vulnerable but SCTP is blocked — effective risk is mitigated"
  fi
fi

if lsmod 2>/dev/null | grep -q '^sctp_diag '; then
  echo "[-] sctp_diag module is LOADED"
elif modprobe -n sctp_diag 2>/dev/null; then
  echo "[!] sctp_diag module can be auto-loaded"
else
  echo "[+] sctp_diag module is BLOCKED or unavailable"
fi

echo ""
echo "=== RESULT: $RESULT ==="
case "$RESULT" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac