Description
The seqfile handling (ip6fl_get_n function in ip6_flowlabel.c) in Linux kernel 2.6 up to 2.6.18-stable allows local users to cause a denial of service (hang or oops) via unspecified manipulations that trigger an infinite loop while searching for flowlabels.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | kernel-source-2.6.8 | 2.6.8-16sarge6 | DSA-1233-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kernel +8 | 2.6.9-42.0.8.EL | RHSA-2007:0014 |
Advisories 2
- RHSA-2007:0014 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-1233-1 kernel-source-2.6.8 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- [linux-kernel] 20061105 Linux 2.6.16.31-rc1 mailing-list
- MDKSA-2007:025 vendor-advisory
- SUSE-SA:2006:079 vendor-advisory
- RHSA-2007:0014 vendor-advisory
- https://issues.rpath.com/browse/RPL-760
- MDKSA-2007:012 vendor-advisory
- 23593 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-063.htm
- 23384 third-party-advisory
- 23752 third-party-advisory
- 20847 vdb-entry
- 24206 third-party-advisory
- oval:org.mitre.oval:def:9311 vdb-entry signature
- 22754 third-party-advisory
- 22665 third-party-advisory
- 23474 third-party-advisory
- DSA-1233 vendor-advisory
- 23370 third-party-advisory
- 20061109 rPSA-2006-0204-1 kernel mailing-list
- 23997 third-party-advisory
- MDKSA-2007:002 vendor-advisory
- http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bcd620757d3a4ae78ef0ca41adb5d9e400ed92b6
- USN-395-1 vendor-advisory
- kernel-seqfile-ipv6-dos(29970) vdb-entry
- ADV-2006-4297 vdb-entry