Description
The IPsec implementation in Linux kernel before 2.6.25 allows remote routers to cause a denial of service (crash) via a fragmented ESP packet in which the first fragment does not contain the entire ESP header and IV.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | fai-kernels | 1.17+etch.22etch2 | DSA-1630-1 |
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-22etch2 | DSA-1630-1 |
| Debian 4.0 | user-mode-linux | 2.6.18-1um-2etch.22etch2 | DSA-1630-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-53.1.21.el5 | RHSA-2008:0275 |
| RHEL 4 | kernel +10 | 2.6.9-67.0.15.EL | RHSA-2008:0237 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | kernel-rt +9 | 2.6.24.7-74.el5rt | RHSA-2008:0585 |
Advisories 4
- RHSA-2008:0585 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2008:0275 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0237 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1630-1 fai-kernels linux-2.6 user-mode-linux - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2008:0275 vendor-advisory
- 30962 third-party-advisory
- DSA-1630 vendor-advisory
- 30294 third-party-advisory
- oval:org.mitre.oval:def:10549 vdb-entry signature
- RHSA-2008:0237 vendor-advisory
- 29081 vdb-entry
- 31551 third-party-advisory
- SUSE-SA:2008:031 vendor-advisory
- RHSA-2008:0585 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=404291
- 31107 third-party-advisory
- 30890 third-party-advisory
- 31628 third-party-advisory
- USN-625-1 vendor-advisory
- SUSE-SA:2008:030 vendor-advisory
- linux-kernel-esp-dos(42276) vdb-entry
- 30818 third-party-advisory
- [linux-netdev] 20080222 [Patch] Crash (BUG()) when handling fragmented ESP packets mailing-list
- 30112 third-party-advisory
- SUSE-SA:2008:032 vendor-advisory