Description
The IPv6 flow label handling code (ip6_flowlabel.c) in Linux kernels 2.4 up to 2.4.32 and 2.6 before 2.6.14 modifies the wrong variable in certain circumstances, which allows local users to corrupt kernel memory or cause a denial of service (crash) by triggering a free of non-allocated memory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | kernel-source-2.4.27 | 2.4.27-10sarge2 | DSA-1018-1 |
| Debian 3.1 | kernel-source-2.6.8 | 2.6.8-16sarge2 | DSA-1017-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kernel +6 | 2.6.9-22.0.2.EL | RHSA-2006:0101 |
| RHEL 3 | kernel +8 | 2.4.21-37.0.1.EL | RHSA-2006:0140 |
Advisories 4
- RHSA-2006:0140 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0101 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1017-1 kernel-source-2.6.8 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1018-1 kernel-source-2.4.27 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2006:0140 vendor-advisory
- 17917 third-party-advisory
- 18684 third-party-advisory
- 18977 third-party-advisory
- SUSE-SA:2005:067 vendor-advisory
- http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4ea6a8046bb49d43c950898f0cb4e1994ef6c89d
- 19369 third-party-advisory
- 18203 third-party-advisory
- RHSA-2006:0101 vendor-advisory
- DSA-1018 vendor-advisory
- oval:org.mitre.oval:def:9903 vdb-entry signature
- SUSE-SA:2005:068 vendor-advisory
- FLSA:157459-2 vendor-advisory
- MDKSA-2006:044 vendor-advisory
- FLSA:157459-4 vendor-advisory
- RHSA-2006:0190 vendor-advisory
- 18510 third-party-advisory
- 15729 vdb-entry
- FLSA:157459-1 vendor-advisory
- MDKSA-2006:018 vendor-advisory
- http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=blobdiff%3Bh=bbbe80cdaf72a75a463aff9551e60b31e2f69061%3Bhp=f841bde30c18493a94fd5d522b84724a8eb82a4a%3Bhb=4ea6a8046bb49d43c950898f0cb4e1994ef6c89d%3Bf=net/ipv6/ip6_flowlabel.c
- MDKSA-2006:072 vendor-advisory
- 17918 third-party-advisory
- DSA-1017 vendor-advisory
- 19374 third-party-advisory
- USN-231-1 vendor-advisory
- RHSA-2006:0191 vendor-advisory
- 18562 third-party-advisory