Description
The Orinoco driver (orinoco.c) in Linux kernel 2.6.13 and earlier does not properly clear memory from a previously used packet whose length is increased, which allows remote attackers to obtain sensitive information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | kernel-source-2.6.8 | 2.6.8-16sarge2 | DSA-1017-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kernel +6 | 2.6.9-22.0.1.EL | RHSA-2005:808 |
| RHEL 3 | kernel +8 | 2.4.21-37.0.1.EL | RHSA-2006:0140 |
Advisories 3
- RHSA-2006:0140 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:808 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1017-1 kernel-source-2.6.8 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDKSA-2005:235 vendor-advisory
- http://www.kernel.org/hg/linux-2.6/?cmd=changeset%3Bnode=feecb2ffde28639e60ede769c6f817dc536c677b
- RHSA-2006:0140 vendor-advisory
- RHSA-2005:808 vendor-advisory
- 17917 third-party-advisory
- 18684 third-party-advisory
- SUSE-SA:2005:067 vendor-advisory
- MDKSA-2005:220 vendor-advisory
- 17364 third-party-advisory
- 75 third-party-advisory
- SUSE-SA:2005:068 vendor-advisory
- FLSA:157459-2 vendor-advisory
- oval:org.mitre.oval:def:11332 vdb-entry signature
- USN-219-1 vendor-advisory
- RHSA-2006:0190 vendor-advisory
- MDKSA-2005:218 vendor-advisory
- FLSA:157459-1 vendor-advisory
- 15085 vdb-entry
- 17280 third-party-advisory
- 17826 third-party-advisory
- FEDORA-2005-1007 vendor-advisory
- 17918 third-party-advisory
- FLSA:157459-3 vendor-advisory
- DSA-1017 vendor-advisory
- MDKSA-2005:219 vendor-advisory
- 17114 third-party-advisory
- 19374 third-party-advisory
- RHSA-2006:0191 vendor-advisory
- 20051012 Linux Orinoco drivers information leakage mailing-list
- 18562 third-party-advisory