CVE-2008-3526: Linux Kernel

High severity, CVSS 7.8. EPSS: 3.5% chance of exploitation in the next 30 days.

Integer overflow in the sctp_setsockopt_auth_key function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel 2.6.24-rc1 through 2.6.26.3 allows remote attackers to cause a denial of service (panic) or possibly have unspecified other impact via a crafted sca_keylength field associated with the SCTP_AUTH_KEY option.

Affected products

• Linux Linux Kernel: version 2.6.24 only; version 2.6.24.1 only; version 2.6.24.2 only; version 2.6.24.3 only; version 2.6.24.4 only; version 2.6.24.5 only; …

Published 2008-08-27. Last modified 2026-06-16.