Linux Kernel CVE-2026-74287

Exploitation requires that the target has the kernel SCTP module loaded and is reachable via SCTP (IP protocol 132) - the malformed ADD_IP, DEL_IP, or SET_PRIMARY ASCONF parameter must be delivered inside an INIT or ASCONF chunk that the SCTP stack will parse, which can occur during association setup. The specific trigger is an embedded address parameter whose addr_param->p.length exceeds the bytes remaining after the sctp_addip_param header. Limiting factors: SCTP must be compiled in and active (many hosts do not run SCTP services and it is commonly blocked at the perimeter), so despite AV:N/PR:N/AC:L the real attack surface is confined to SCTP-enabled systems such as telecom/SIGTRAN gateways and certain clustering deployments; no authentication or user interaction is needed once SCTP packets can reach the host.

The signals conflict in a way worth stating plainly: the CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/A:H) yields 9.1 CRITICAL implying trivial remote unauthenticated compromise, yet EPSS is only 0.18% (7th percentile) and there is no KEV listing and no known POC, indicating low real-world exploitation likelihood. This gap is typical of Linux stable-tree CVEs, which are auto-assigned high scores from the mechanical impact of the code path rather than demonstrated attacks. Practical risk is further gated by exposure: SCTP must be compiled in and actually reachable (the module auto-loads on socket use, but many hosts neither run SCTP services nor accept SCTP packets past the firewall). The realistic worst case is remote information disclosure (kernel memory leak) or a crash/DoS, not code execution - I:N in the vector means no integrity impact and the described primitive is an out-of-bounds read. Treat this as a routine-priority kernel patch for general fleets, but elevate it for hosts running SCTP-dependent workloads (telecom/SIGTRAN, some clustering).

An attacker able to send SCTP traffic to a target host crafts an INIT or ASCONF chunk containing an ADD_IP/DEL_IP/SET_PRIMARY parameter whose embedded address parameter declares a length longer than the enclosing parameter, causing the kernel to read beyond the buffer while parsing the address payload. This yields a kernel memory over-read that can leak adjacent memory contents or crash the host (DoS). No public POC has been identified at time of analysis, and low attack complexity means a single crafted packet suffices where SCTP is reachable.