Description
Linux kernel before 2.6.16.5 does not properly handle uncanonical return addresses on Intel EM64T CPUs, which reports an exception in the SYSRET instead of the next instruction, which causes the kernel exception handler to run on the user stack with the wrong GS.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | kernel-source-2.6.8 | 2.6.8-16sarge3 | DSA-1103 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kernel +8 | 2.6.9-34.0.1.EL | RHSA-2006:0493 |
| RHEL 3 | kernel +8 | 2.4.21-47.EL | RHSA-2006:0437 |
Advisories 3
- RHSA-2006:0493 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0437 Red Hat Security Advisory: Updated kernel packages for Red Hat Enterprise Linux 3 Update 8 Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1103 kernel-source-2.6.8 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://support.avaya.com/elmodocs2/security/ASA-2006-161.htm
- linux-uncanonical-addr-dos(25869) vdb-entry
- RHSA-2006:0493 vendor-advisory
- RHSA-2006:0437 vendor-advisory
- SUSE-SA:2006:042 vendor-advisory
- 19735 third-party-advisory
- ADV-2006-2554 vdb-entry
- 20716 third-party-advisory
- FEDORA-2006-423 vendor-advisory
- 21745 third-party-advisory
- SUSE-SA:2006:047 vendor-advisory
- 21136 third-party-advisory
- MDKSA-2006:150 vendor-advisory
- 19639 third-party-advisory
- USN-302-1 vendor-advisory
- 21983 third-party-advisory
- SUSE-SA:2006:028 vendor-advisory
- ADV-2006-1390 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-180.htm
- DSA-1103 vendor-advisory
- 17541 vdb-entry
- http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.5
- ADV-2006-1475 vdb-entry
- 24639 vdb-entry
- 21498 third-party-advisory
- 20237 third-party-advisory
- 20398 third-party-advisory
- oval:org.mitre.oval:def:9732 vdb-entry signature
- MDKSA-2006:086 vendor-advisory
- 20157 third-party-advisory
- 21179 third-party-advisory
- 20914 third-party-advisory