Description
The NAT code (1) ip_nat_proto_tcp.c and (2) ip_nat_proto_udp.c in Linux kernel 2.6 before 2.6.13 and 2.4 before 2.4.32-rc1 incorrectly declares a variable to be static, which allows remote attackers to cause a denial of service (memory corruption) by causing two packets for the same protocol to be NATed at the same time, which leads to memory corruption.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | kernel-image-2.4.27-arm +1 | 2.4.27-2sarge1 | DSA-921-1 |
| Debian 3.1 | kernel-image-2.4.27-m68k | 2.4.27-3sarge1 | DSA-921-1 |
| Debian 3.1 | kernel-image-2.4.27-sparc | 2.4.27-9sarge1 | DSA-921-1 |
| Debian 3.1 | kernel-image-2.6.8-hppa | 2.6.8-6sarge1 | DSA-922-1 |
| Debian 3.1 | kernel-image-2.6.8-ia64 | 2.6.8-14sarge1 | DSA-922-1 |
| Debian 3.1 | kernel-image-2.6.8-m68k | 2.6.8-4sarge1 | DSA-922-1 |
| Debian 3.1 | kernel-image-2.6.8-s390 | 2.6.8-5sarge1 | DSA-922-1 |
| Debian 3.1 | kernel-image-2.6.8-sparc | 2.6.8-15sarge1 | DSA-922-1 |
| Debian 3.1 | kernel-patch-2.4.27-arm | 2.4.27-1sarge1 | DSA-921-1 |
| Debian 3.1 | kernel-patch-2.4.27-mips | 2.4.27-10.sarge1.040815-1 | DSA-921-1 |
| Debian 3.1 | kernel-patch-powerpc-2.6.8 | 2.6.8-12sarge1 | DSA-922-1 |
| Debian 3.1 | kernel-source-2.4.27 +4 | 2.4.27-10sarge1 | DSA-921-1 |
| Debian 3.1 | kernel-source-2.6.8 +3 | 2.6.8-16sarge1 | DSA-922-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kernel +6 | 2.6.9-22.EL | RHSA-2005:514 |
| RHEL 3 | kernel +8 | 2.4.21-37.0.1.EL | RHSA-2006:0140 |
Advisories 4
- RHSA-2006:0140 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:514 Red Hat Security Advisory: Updated kernel packages available for Red Hat Enterprise Linux 4 Update 2 Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-921-1 kernel-source-2.4.27 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-922-1 kernel-source-2.6.8 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2006:0140 vendor-advisory
- 18684 third-party-advisory
- 18056 third-party-advisory
- 18977 third-party-advisory
- MDKSA-2005:220 vendor-advisory
- oval:org.mitre.oval:def:10142 vdb-entry signature
- 18059 third-party-advisory
- 19185 third-party-advisory
- 19607 third-party-advisory
- SUSE-SA:2005:068 vendor-advisory
- FLSA:157459-2 vendor-advisory
- MDKSA-2006:044 vendor-advisory
- DSA-922 vendor-advisory
- USN-219-1 vendor-advisory
- RHSA-2006:0190 vendor-advisory
- MDKSA-2005:218 vendor-advisory
- FLSA:157459-1 vendor-advisory
- DSA-921 vendor-advisory
- http://linux.bkbits.net:8080/linux-2.6/cset%4042e14e05d0V1d88nZlaIX1F9dCRApA
- 15531 vdb-entry
- 17826 third-party-advisory
- 17918 third-party-advisory
- FLSA:157459-3 vendor-advisory
- MDKSA-2005:219 vendor-advisory
- RHSA-2006:0191 vendor-advisory
- 18562 third-party-advisory