Description
Race condition in the page fault handler (fault.c) for Linux kernel 2.2.x to 2.2.7, 2.4 to 2.4.29, and 2.6 to 2.6.10, when running on multiprocessor machines, allows local users to execute arbitrary code via concurrent threads that share the same virtual memory space and simultaneously request stack expansion.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | kernel-image-sparc-2.4 | 26woody1 | DSA-1070-1 |
| Debian 3.0 | kernel-patch-2.4.19-mips | 2.4.19-0.020911.1.woody5 | DSA-1070-1 |
| Debian 3.0 | kernel-source-2.4.16 | 2.4.16-1woody2 | DSA-1067-1 |
| Debian 3.0 | kernel-source-2.4.17 | 2.4.17-1woody4 | DSA-1082-1 |
| Debian 3.0 | kernel-source-2.4.18 | 2.4.18-14.4 | DSA-1069-1 |
| Debian 3.0 | kernel-source-2.4.19 | 2.4.19-4.woody3 | DSA-1070-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kernel +6 | 2.6.9-5.0.3.EL | RHSA-2005:092 |
Advisories 5
- RHSA-2005:092 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1082-1 kernel-source-2.4.17 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1067-1 kernel-source-2.4.16 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1069-1 kernel-source-2.4.18 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1070-1 kernel-source-2.4.19 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20163 third-party-advisory
- 13822 third-party-advisory
- DSA-1082 vendor-advisory
- MDKSA-2005:022 vendor-advisory
- RHSA-2005:017 vendor-advisory
- FLSA:2336 vendor-advisory
- 20050112 Linux kernel i386 SMP page fault handler privilege escalation mailing-list
- oval:org.mitre.oval:def:10322 vdb-entry signature
- DSA-1070 vendor-advisory
- RHSA-2005:016 vendor-advisory
- RHSA-2005:043 vendor-advisory
- 2005-0001 vendor-advisory
- RHSA-2005:092 vendor-advisory
- linux-fault-handler-gain-privileges(18849) vdb-entry
- DSA-1067 vendor-advisory
- DSA-1069 vendor-advisory
- CLA-2005:930 vendor-advisory
- 20050114 [USN-60-0] Linux kernel vulnerabilities mailing-list
- http://isec.pl/vulnerabilities/isec-0022-pagefault.txt
- 20050112 Linux kernel i386 SMP page fault handler privilege escalation mailing-list
- 20202 third-party-advisory
- 12244 vdb-entry
- 20338 third-party-advisory
- 1012862 vdb-entry