Description
VFS in the Linux kernel before 2.6.22.16, and 2.6.23.x before 2.6.23.14, performs tests of access mode by using the flag variable instead of the acc_mode variable, which might allow local users to bypass intended permissions and remove directories.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-17etch1 | DSA-1479-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-53.1.6.el5 | RHSA-2008:0089 |
| RHEL 4 | kernel +10 | 2.6.9-67.0.4.EL | RHSA-2008:0055 |
Advisories 3
- RHSA-2008:0089 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0055 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1479-1 linux-2.6 Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=974a9f0b47da74e28f68b9c8645c3786aa5ace1a
- http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.16
- ADV-2008-0151 vdb-entry
- 28806 third-party-advisory
- 28643 third-party-advisory
- 28628 third-party-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.23.14
- 28485 third-party-advisory
- 20080117 rPSA-2008-0021-1 kernel mailing-list
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0021
- 28706 third-party-advisory
- 28626 third-party-advisory
- DSA-1479 vendor-advisory
- MDVSA-2008:112 vendor-advisory
- 28558 third-party-advisory
- SUSE-SA:2008:013 vendor-advisory
- https://issues.rpath.com/browse/RPL-2146
- oval:org.mitre.oval:def:9709 vdb-entry signature
- MDVSA-2008:044 vendor-advisory
- 29245 third-party-advisory
- 28664 third-party-advisory
- 1019289 vdb-entry
- SUSE-SA:2008:006 vendor-advisory
- 28748 third-party-advisory
- USN-574-1 vendor-advisory
- linux-directory-security-bypass(39672) vdb-entry
- FEDORA-2008-0748 vendor-advisory
- 28971 third-party-advisory
- RHSA-2008:0089 vendor-advisory
- USN-578-1 vendor-advisory
- 27280 vdb-entry
- RHSA-2008:0055 vendor-advisory