Description
The aio_setup_ring function in Linux kernel does not properly initialize a variable, which allows local users to cause a denial of service (crash) via an unspecified error path that causes an incorrect free operation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | kernel-source-2.6.8 | 2.6.8-16sarge7 | DSA-1304-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kernel +8 | 2.6.9-42.0.8.EL | RHSA-2007:0014 |
Advisories 2
- RHSA-2007:0014 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-1304-1 kernel-source-2.6.8 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDKSA-2007:025 vendor-advisory
- RHSA-2007:0014 vendor-advisory
- oval:org.mitre.oval:def:11234 vdb-entry signature
- http://support.avaya.com/elmodocs2/security/ASA-2007-063.htm
- 25683 third-party-advisory
- 22193 vdb-entry
- 24206 third-party-advisory
- 23997 third-party-advisory
- DSA-1304 vendor-advisory
- 25714 third-party-advisory
- SUSE-SA:2007:035 vendor-advisory