Description
The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to 2.6.17, and possibly later versions, allows local users to cause a denial of service (memory consumption) by writing more data to the serial port than the hardware can handle, which causes the data to be queued.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | fai-kernels | 1.9.1sarge4 | DSA-1184-2 |
| Debian 3.1 | kernel-source-2.6.8 | 2.6.8-16sarge5 | DSA-1184-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kernel +8 | 2.6.9-42.0.2.EL | RHSA-2006:0617 |
Advisories 2
- RHSA-2006:0617 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1184-2 kernel-source-2.6.8 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.kernel.org/git/?p=linux/kernel/git/gregkh/patches.git%3Ba=blob%3Bh=4b4d9cfea17618b80d3ac785b701faeaf60141f1%3Bhb=396eb2aac550ec55856c6843ef9017e800c3d656
- 20703 third-party-advisory
- USN-331-1 vendor-advisory
- 21934 third-party-advisory
- linux-ftdi-sio-dos(27807) vdb-entry
- 19033 vdb-entry
- 27119 vdb-entry
- ADV-2006-2841 vdb-entry
- RHSA-2006:0617 vendor-advisory
- 21298 third-party-advisory
- 21057 third-party-advisory
- 21605 third-party-advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=197610
- MDKSA-2006:150 vendor-advisory
- SUSE-SA:2007:021 vendor-advisory
- MDKSA-2006:151 vendor-advisory
- 25226 third-party-advisory
- 21614 third-party-advisory
- 25683 third-party-advisory
- 22174 third-party-advisory
- oval:org.mitre.oval:def:10265 vdb-entry signature
- USN-346-1 vendor-advisory
- SUSE-SA:2007:018 vendor-advisory
- 24547 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-203.htm
- SUSE-SA:2007:030 vendor-advisory
- SUSE-SA:2007:035 vendor-advisory
- 22093 third-party-advisory
- 20060717 rPSA-2006-0130-1 kernel mailing-list
- DSA-1184 vendor-advisory