Description
The zlib_inflate function in Linux kernel 2.6.x allows local users to cause a denial of service (crash) via a malformed filesystem that uses zlib compression that triggers memory corruption, as demonstrated using cramfs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | fai-kernels | 1.9.1sarge8 | DSA-1504-1 |
| Debian 3.1 | hostap-modules-i386 | 1:0.3.7-1sarge3 | DSA-1503-1 |
| Debian 3.1 | i2c | 1:2.9.1-1sarge2 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.4.27-arm +1 | 2.4.27-2sarge6 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.4.27-m68k | 2.4.27-3sarge6 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.4.27-sparc | 2.4.27-9sarge6 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.6.8-hppa | 2.6.8-7sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-ia64 | 2.6.8-15sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-m68k | 2.6.8-5sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-s390 | 2.6.8-6sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-sparc | 2.6.8-16sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-speakup-i386 | 2.4.27-1.1sarge5 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-alpha | 101sarge3 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-i386 | 101sarge2 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-s390 | 2.4.27-1sarge2 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-sparc | 42sarge3 | DSA-1503-1 |
| Debian 3.1 | kernel-patch-2.4.27-mips | 2.4.27-10.sarge4.040815-3 | DSA-1503-1 |
| Debian 3.1 | kernel-patch-powerpc-2.6.8 | 2.6.8-13sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-source-2.4.27 +4 | 2.4.27-10sarge6 | DSA-1503-2, DSA-1503-1 |
| Debian 3.1 | kernel-source-2.6.8 +3 | 2.6.8-17sarge1 | DSA-1504-1 |
| Debian 3.1 | mindi-kernel | 2.4.27-2sarge5 | DSA-1503-1 |
| Debian 3.1 | pcmcia-modules-2.4.27-i386 | 3.2.5+2sarge2 | DSA-1503-1 |
| Debian 3.1 | systemimager | 3.2.3-6sarge5 | DSA-1503-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kernel +8 | 2.6.9-42.0.8.EL | RHSA-2007:0014 |
| RHEL 3 | kernel +8 | 2.4.21-50.EL | RHSA-2007:0436 |
Advisories 5
- RHSA-2007:0014 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2007:0436 Red Hat Security Advisory: Updated kernel packages for Red Hat Enterprise Linux 3 Update 9 Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1503-2 kernel-source-2.4.27 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1503-1 kernelimage-2.4.27 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1504-1 kernel-image-2.6.8 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2007:0436 vendor-advisory
- 24098 third-party-advisory
- SUSE-SA:2006:079 vendor-advisory
- 24259 third-party-advisory
- RHSA-2007:0014 vendor-advisory
- http://projects.info-pull.com/mokb/MOKB-07-11-2006.html
- MDKSA-2007:047 vendor-advisory
- 22767 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-063.htm
- USN-416-1 vendor-advisory
- DSA-1504 vendor-advisory
- oval:org.mitre.oval:def:10588 vdb-entry signature
- 24206 third-party-advisory
- 23474 third-party-advisory
- 23997 third-party-advisory
- 20070615 rPSA-2007-0124-1 kernel xen mailing-list
- 24482 third-party-advisory
- DSA-1503 vendor-advisory
- 29058 third-party-advisory
- 25630 third-party-advisory
- 25691 third-party-advisory
- MDKSA-2007:060 vendor-advisory