Description
madvise_remove in Linux kernel 2.6.16 up to 2.6.16.6 does not follow file and mmap restrictions, which allows local users to bypass IPC permissions and replace portions of readonly tmpfs files with zeroes, aka the MADV_REMOVE vulnerability. NOTE: this description was originally written in a way that combined two separate issues. The mprotect issue now has a separate name, CVE-2006-2071.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | kernel-source-2.4.27 | 2.4.27-10sarge3 | DSA-1097-1 |
| Debian 3.1 | kernel-source-2.6.8 | 2.6.8-16sarge3 | DSA-1103 |
Advisories 2
- DSA-1097-1 kernel-source-2.4.27 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1103 kernel-source-2.6.8 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- linux-madvise-security-bypass(25870) vdb-entry
- 19735 third-party-advisory
- ADV-2006-2554 vdb-entry
- ADV-2006-1391 vdb-entry
- 19664 third-party-advisory
- FEDORA-2006-423 vendor-advisory
- DSA-1097 vendor-advisory
- SUSE-SA:2006:028 vendor-advisory
- DSA-1103 vendor-advisory
- 24714 vdb-entry
- 17587 vdb-entry
- ADV-2006-1475 vdb-entry
- 20398 third-party-advisory
- http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.6
- 19657 third-party-advisory
- 20671 third-party-advisory
- 20914 third-party-advisory