The Patching Friars' AlmanacA calendar of CVE saints

September 18

DiagSpillHoly card for diagspill, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 65535→0 DiagSpill NUMERUS REDIT NIHIL
🤖 Image and text generated with AI

⬇ Download holy card: ·

⚔ Commemorated today: The Scourge of Nimda, Admin Backwards (2001)

Embed on your site

Saint DiagSpill, Who Overflowed Counting the Peers

Patron of the SCTP protocol, 16-bit counters, and diagnostic responses that write too much.

Life

On 18 September 2026 Asim Viladi Oglu Manizada described DiagSpill, a flaw in the Linux kernel. An SCTP association can have up to 65,536 peers, but the counter was 16 bits wide: the 65,536th wrapped it to zero, and the sctp_diag diagnostic interface, no longer reserving room, kept copying the full list, writing about 8 MiB past the buffer. With no special privileges needed, it led to a root shell.

Prayer

O Saint DiagSpill, who overflow at the exact turn of the counter, let our diagnostic responses always reserve the space they write. Amen.

How to celebrate

Celebrated by updating the kernel to the fixed releases, which reject the one peer too many instead of zeroing the count.

A counter that wraps, a buffer that spills.

Technical record

Disclosed on
September 18 2026
CVE
CVE-2026-74469
CVSS
8.8
Product
Linux · Linux

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, then copies one sockaddr_storage for every entry in transport_addr_list. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail. Reject a new unique peer when transport_count has reached U16_MAX. Perform the check after the existing-peer lookup so a duplicate address continues to return its existing transport at the limit.

Sources: heyitsas.im · openwall.com

Commemorated today

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.