Description
Race condition between the kfree_skb and __skb_unlink functions in the socket buffer handling in Linux kernel 2.6.9, and possibly other versions, allows remote attackers to cause a denial of service (crash), as demonstrated using the TCP stress tests from the LTP test suite.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | fai-kernels | 1.9.1sarge4 | DSA-1184-2, DSA-1183-1 |
| Debian 3.1 | kernel-source-2.4.27 | 2.4.27-10sarge4 | DSA-1183-1 |
| Debian 3.1 | kernel-source-2.6.8 | 2.6.8-16sarge5 | DSA-1184-2 |
| Debian 3.1 | systemimager | 3.2.3-6sarge3 | DSA-1183-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kernel +8 | 2.6.9-42.EL | RHSA-2006:0575 |
Advisories 3
- RHSA-2006:0575 Red Hat Security Advisory: Updated kernel packages available for Red Hat Enterprise Linux 4 Update 4 Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1183-1 kernel-source-2.4.27 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1184-2 kernel-source-2.6.8 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDKSA-2007:025 vendor-advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=192779
- DSA-1183 vendor-advisory
- 22082 third-party-advisory
- RHSA-2006:0575 vendor-advisory
- oval:org.mitre.oval:def:9117 vdb-entry signature
- 21465 third-party-advisory
- 19475 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm
- 22417 third-party-advisory
- 22093 third-party-advisory
- DSA-1184 vendor-advisory