CVE-2026-3608 is a reachable assertion vulnerability (CWE-617) in ISC Kea DHCP server components (kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, kea-dhcp6). A specially crafted message sent over any configured API socket or HA listener can trigger a stack overflow, causing the daemon to exit unexpectedly. This results in a denial of service condition. The issue affects Kea versions 2.6.0 through 2.6.4 and 3.0.0 through 3.0.2. Red Hat has released security advisories and patches for affected packages in Red Hat Enterprise Linux 10.0 Extended Update Support. The CVSS v3.1 score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Exploitation of this vulnerability causes the affected Kea DHCP daemons to crash due to a stack overflow triggered by a maliciously crafted message. This results in denial of service, disrupting DHCP services such as address assignment and renewal. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been documented at this time.

Red Hat has issued security updates addressing CVE-2026-3608 for affected Kea packages in Red Hat Enterprise Linux 10.0 Extended Update Support. Applying these official patches will remediate the vulnerability. Users should follow Red Hat's update instructions at https://access.redhat.com/articles/11258 to install the fixed versions. Since this is not a cloud service, remediation depends on applying vendor patches. Patch status is confirmed by Red Hat advisories. No additional mitigation steps are indicated by the vendor.