Description
The IA32 system call emulation functionality in Linux kernel 2.4.x and 2.6.x before 2.6.22.7, when running on the x86_64 architecture, does not zero extend the eax register after the 32bit entry path to ptrace is used, which might allow local users to gain privileges by triggering an out-of-bounds access to the system call table using the %RAX register.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | fai-kernels | 1.17+etch.13etch3 | DSA-1378-2, DSA-1378-1 |
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-13etch3 | DSA-1381-2, DSA-1378-2, DSA-1378-1 |
| Debian 4.0 | user-mode-linux | 2.6.18-1um-2etch.13etch3 | DSA-1378-2, DSA-1378-1 |
| Debian 3.1 | fai-kernels | 1.9.1sarge8 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-hppa | 2.6.8-7sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-ia64 | 2.6.8-15sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-m68k | 2.6.8-5sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-s390 | 2.6.8-6sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-sparc | 2.6.8-16sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-patch-powerpc-2.6.8 | 2.6.8-13sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-source-2.6.8 +3 | 2.6.8-17sarge1 | DSA-1504-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +9 | 2.6.18-8.1.14.el5 | RHSA-2007:0936 |
| RHEL 4 | kernel +10 | 2.6.9-55.0.9.EL | RHSA-2007:0937 |
| RHEL 3 | kernel +8 | 2.4.21-52.EL | RHSA-2007:0938 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Linux Kernel 2.4/2.6 (x86-64) - System Call Emulation Privilege Escalation EDB-4460 · local · Sep 27, 2007 · verified
- Linux Kernel 2.6.x - Ptrace Privilege Escalation EDB-30604 · local · Sep 21, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- RHSA-2007:0936 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0938 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0937 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1378-2 fai-kernels linux-2.6 user-mode-linux - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1504-1 kernel-image-2.6.8 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1381-2 linux-2.6 Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1378-1 fai-kernels linux-2.6 user-mode-linux - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2007:0937 vendor-advisory
- 27212 third-party-advisory
- 27227 third-party-advisory
- RHSA-2007:0938 vendor-advisory
- SUSE-SA:2007:053 vendor-advisory
- 1018748 vdb-entry
- 26953 third-party-advisory
- FEDORA-2007-2298 vendor-advisory
- 20070924 COSEINC Linux Advisory #2: IA32 System Call Emulation Vulnerability mailing-list
- 26978 third-party-advisory
- [linux-kernel] 20070921 Linux 2.6.22.7 mailing-list
- 26934 third-party-advisory
- 26994 third-party-advisory
- 26995 third-party-advisory
- DSA-1504 vendor-advisory
- 25774 vdb-entry
- MDVSA-2008:008 vendor-advisory
- 26919 third-party-advisory
- 27912 third-party-advisory
- USN-518-1 vendor-advisory
- ADV-2007-3246 vdb-entry
- [linux-kernel] 20070921 Re: Linux 2.6.22.7 mailing-list
- 20070926 Re: COSEINC Linux Advisory #2: IA32 System CallEmulation Vulnerability mailing-list
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.7
- oval:org.mitre.oval:def:9735 vdb-entry signature
- FEDORA-2007-712 vendor-advisory
- DSA-1381 vendor-advisory
- 20070924 COSEINC Linux Advisory #2: IA32 System Call mailing-list
- http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.35.3
- MDKSA-2007:196 vendor-advisory
- MDVSA-2008:105 vendor-advisory
- SUSE-SA:2007:064 vendor-advisory
- RHSA-2007:0936 vendor-advisory
- 26955 third-party-advisory
- 29058 third-party-advisory
- https://issues.rpath.com/browse/RPL-1754
- 26917 third-party-advisory
- DSA-1378 vendor-advisory
- MDKSA-2007:195 vendor-advisory