Description
Integer overflow in the dccp_feat_change function in net/dccp/feat.c in the Datagram Congestion Control Protocol (DCCP) subsystem in the Linux kernel 2.6.18, and 2.6.17 through 2.6.20, allows local users to gain privileges via an invalid feature length, which leads to a heap-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-18etch6 | DSA-1592-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-92.1.6.el5 | RHSA-2008:0519 |
Advisories 2
- RHSA-2008:0519 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1592-1 linux-2.6 - overflow conditions Debian Security (DSA / DLA) · Mar 9, 2026
References
- 30000 third-party-advisory
- 29603 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=447389
- RHSA-2008:0519 vendor-advisory
- MDVSA-2008:167 vendor-advisory
- 30849 third-party-advisory
- oval:org.mitre.oval:def:9644 vdb-entry signature
- MDVSA-2008:112 vendor-advisory
- 30920 third-party-advisory
- 1020211 vdb-entry
- 31107 third-party-advisory
- FEDORA-2008-5893 vendor-advisory
- USN-625-1 vendor-advisory
- DSA-1592 vendor-advisory
- SUSE-SA:2008:030 vendor-advisory
- 30818 third-party-advisory
- linux-kernel-dccpfeatchange-bo(43034) vdb-entry