Description
The nl_fib_lookup function in net/ipv4/fib_frontend.c in Linux Kernel before 2.6.20.8 allows attackers to cause a denial of service (kernel panic) via NETLINK_FIB_LOOKUP replies, which trigger infinite recursion and a stack overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-12etch2 | DSA-1289-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +10 | 2.6.18-8.1.4.el5 | RHSA-2007:0347 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Linux Kernel 2.6.x - NETLINK_FIB_LOOKUP Local Denial of Service EDB-29916 · dos · Apr 26, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2007:0347 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1289-1 linux-2.6 Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://issues.rpath.com/browse/RPL-1309
- RHSA-2007:0347 vendor-advisory
- 20070508 FLEA-2007-0016-1: kernel mailing-list
- SUSE-SA:2007:043 vendor-advisory
- 25030 third-party-advisory
- 23677 vdb-entry
- MDKSA-2007:171 vendor-advisory
- http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.8
- kernel-netlinkfiblookup-dos(34014) vdb-entry
- DSA-1289 vendor-advisory
- 25288 third-party-advisory
- 25083 third-party-advisory
- 26620 third-party-advisory
- ADV-2007-1595 vdb-entry
- USN-489-1 vendor-advisory
- 25228 third-party-advisory
- 20070615 rPSA-2007-0124-1 kernel xen mailing-list
- 25961 third-party-advisory
- oval:org.mitre.oval:def:11616 vdb-entry signature
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237913
- USN-486-1 vendor-advisory
- 25691 third-party-advisory
- 26139 third-party-advisory
- 26133 third-party-advisory