Description
Multiple race conditions in the terminal layer in Linux 2.4.x, and 2.6.x before 2.6.9, allow (1) local users to obtain portions of kernel data via a TIOCSETD ioctl call to a terminal interface that is being accessed by another thread, or (2) remote attackers to cause a denial of service (panic) by switching from console to PPP line discipline, then quickly sending data that is received during the switch.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | kernel +8 | 2.4.21-27.0.4.EL | RHSA-2005:293 |
Advisories 1
- RHSA-2005:293 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=133110
- MDKSA-2005:022 vendor-advisory
- 20041214 [USN-38-1] Linux kernel vulnerabilities mailing-list
- FLSA:2336 vendor-advisory
- linux-tiocsetd-race-condition(17816) vdb-entry
- 20041020 CAN-2004-0814: Linux terminal layer races mailing-list
- 11492 vdb-entry
- 11491 vdb-entry
- RHSA-2005:293 vendor-advisory
- http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=131672
- oval:org.mitre.oval:def:10728 vdb-entry signature