Linux Kernel EUVD-2026-59662

The SCTP kernel module must be loaded and the target must accept SCTP connections from the attacker's network. The attacker must successfully add exactly 65,535 unique peer transport addresses to a single SCTP association - this is the specific precondition defined in the CVE: the overflow triggers on the 65,536th unique peer addition via sctp_assoc_add_peer(). Duplicate address additions do not increment the counter (the fix explicitly preserves this behavior), so the attacker must supply 65,535 genuinely distinct peer addresses. The out-of-bounds write occurs when the sock_diag INET_DIAG_PEERS diagnostic dump is triggered, typically via netlink by local tools (iproute2 ss, monitoring agents); it is not directly remote-triggerable in standard configurations - a second local or privileged trigger step is required to convert the corrupted counter into memory corruption. Factors limiting exploitation: the 65,535-peer accumulation threshold is operationally demanding; the OOB write trigger requires a sock_diag invocation that is normally local; and SCTP multi-homing is not enabled by default in most application-layer software. The CVSS PR:L rating aligns with the need to establish and maintain a persistent SCTP association.

The CVSS 3.1 score of 8.8 (High) reflects network accessibility, low complexity, and high C/I/A impact, but real-world exploitation risk is materially lower than this rating implies. To trigger the overflow, an attacker must first accumulate 65,535 unique peer transport addresses within a single SCTP association - a substantial operational threshold requiring persistent connectivity and potentially large numbers of distinct source addresses or repeated SCTP address management messages. Additionally, the triggering mechanism (the sock_diag INET_DIAG_PEERS diagnostic dump) is typically invoked via netlink by local processes running tools such as iproute2's ss command, not directly by remote parties; CVSS AV:N captures the peer-flooding phase but the full exploit chain may require a secondary local trigger, which the vector does not explicitly reflect. The EPSS score of 0.17% (6th percentile) strongly corroborates a low current exploitation probability. No CISA KEV listing and no public POC exist. However, the impact primitive - a controlled ~8 MiB kernel heap out-of-bounds write - is a serious primitive for kernel exploit developers and should not be dismissed for high-value targets. CVSS AC:L may understate actual attack complexity; AC:H is more reflective of the 65,535-peer precondition. CVSS PR:L is plausible but SCTP itself requires no credential authentication, so PR:N may better represent the true privilege model.

A remote attacker with network-level access to a target exposing SCTP services establishes an association and repeatedly sends SCTP address-management messages adding 65,535 distinct peer transport addresses, wrapping the 16-bit transport_count to zero. When a local administrative user subsequently runs a diagnostic tool such as ss or a monitoring agent that invokes the INET_DIAG sock_diag interface, the kernel allocates a zero-length payload for INET_DIAG_PEERS but copies all 65,536 peer sockaddr_storage entries - approximately 8 MiB - past the socket buffer tail, corrupting adjacent kernel heap structures and potentially enabling a kernel panic or code execution at ring 0. No public proof-of-concept exploit has been identified at time of analysis.