Description
Exec in Linux kernel 2.6 does not properly clear posix-timers in multi-threaded environments, which results in a resource leak and could allow a large number of multiple local users to cause a denial of service by using more posix-timers than specified by the quota for a single user.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | kernel-image-2.6.8-hppa | 2.6.8-6sarge1 | DSA-922-1 |
| Debian 3.1 | kernel-image-2.6.8-ia64 | 2.6.8-14sarge1 | DSA-922-1 |
| Debian 3.1 | kernel-image-2.6.8-m68k | 2.6.8-4sarge1 | DSA-922-1 |
| Debian 3.1 | kernel-image-2.6.8-s390 | 2.6.8-5sarge1 | DSA-922-1 |
| Debian 3.1 | kernel-image-2.6.8-sparc | 2.6.8-15sarge1 | DSA-922-1 |
| Debian 3.1 | kernel-patch-powerpc-2.6.8 | 2.6.8-12sarge1 | DSA-922-1 |
| Debian 3.1 | kernel-source-2.6.8 +3 | 2.6.8-16sarge1 | DSA-922-1 |
Advisories 1
- DSA-922-1 kernel-source-2.6.8 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 17917 third-party-advisory
- 18056 third-party-advisory
- http://linux.bkbits.net:8080/linux-2.6/cset%40414b332fsZQvEUsfzKJIo-q2_ZH0hg
- SUSE-SA:2005:067 vendor-advisory
- 15533 vdb-entry
- DSA-922 vendor-advisory
- USN-219-1 vendor-advisory
- [linux-kernel] 20040911 [PATCH] exec: fix posix-timers leak and pending signal loss mailing-list
- MDKSA-2005:218 vendor-advisory
- 17826 third-party-advisory
- MDKSA-2005:219 vendor-advisory