Description
The disconnect method in the Philips USB Webcam (pwc) driver in Linux kernel 2.6.x before 2.6.22.6 "relies on user space to close the device," which allows user-assisted local attackers to cause a denial of service (USB subsystem hang and CPU consumption in khubd) by not closing the device after the disconnect is invoked. NOTE: this rarely crosses privilege boundaries, unless the attacker can convince the victim to unplug the affected device.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-13etch4 | DSA-1381-2 |
| Debian 3.1 | fai-kernels | 1.9.1sarge8 | DSA-1504-1 |
| Debian 3.1 | hostap-modules-i386 | 1:0.3.7-1sarge3 | DSA-1503-1 |
| Debian 3.1 | i2c | 1:2.9.1-1sarge2 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.4.27-arm +1 | 2.4.27-2sarge6 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.4.27-m68k | 2.4.27-3sarge6 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.4.27-sparc | 2.4.27-9sarge6 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.6.8-hppa | 2.6.8-7sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-ia64 | 2.6.8-15sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-m68k | 2.6.8-5sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-s390 | 2.6.8-6sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-sparc | 2.6.8-16sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-speakup-i386 | 2.4.27-1.1sarge5 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-alpha | 101sarge3 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-i386 | 101sarge2 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-s390 | 2.4.27-1sarge2 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-sparc | 42sarge3 | DSA-1503-1 |
| Debian 3.1 | kernel-patch-2.4.27-mips | 2.4.27-10.sarge4.040815-3 | DSA-1503-1 |
| Debian 3.1 | kernel-patch-powerpc-2.6.8 | 2.6.8-13sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-source-2.4.27 +4 | 2.4.27-10sarge6 | DSA-1503-2, DSA-1503-1 |
| Debian 3.1 | kernel-source-2.6.8 +3 | 2.6.8-17sarge1 | DSA-1504-1 |
| Debian 3.1 | mindi-kernel | 2.4.27-2sarge5 | DSA-1503-1 |
| Debian 3.1 | pcmcia-modules-2.4.27-i386 | 3.2.5+2sarge2 | DSA-1503-1 |
| Debian 3.1 | systemimager | 3.2.3-6sarge5 | DSA-1503-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-53.1.21.el5 | RHSA-2008:0275 |
| RHEL 4 | kernel +10 | 2.6.9-78.0.8.EL | RHSA-2008:0972 |
Advisories 6
- RHSA-2008:0275 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0972 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1503-2 kernel-source-2.4.27 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1503-1 kernelimage-2.4.27 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1504-1 kernel-image-2.6.8 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1381-2 linux-2.6 Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2008:0275 vendor-advisory
- 30294 third-party-advisory
- 20070902 Oops in pwc v4l driver mailing-list
- 20070903 Re: Oops in pwc v4l driver mailing-list
- RHSA-2008:0972 vendor-advisory
- 28706 third-party-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.6
- 26994 third-party-advisory
- DSA-1504 vendor-advisory
- MDVSA-2008:008 vendor-advisory
- oval:org.mitre.oval:def:10494 vdb-entry signature
- USN-558-1 vendor-advisory
- DSA-1381 vendor-advisory
- MDVSA-2008:105 vendor-advisory
- DSA-1503 vendor-advisory
- USN-574-1 vendor-advisory
- 29058 third-party-advisory
- 28971 third-party-advisory
- 25504 vdb-entry
- 28170 third-party-advisory
- 32799 third-party-advisory
- USN-578-1 vendor-advisory