Description
The do_splice_from function in fs/splice.c in the Linux kernel before 2.6.27 does not reject file descriptors that have the O_APPEND flag set, which allows local users to bypass append mode and make arbitrary changes to other locations in the file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | fai-kernels | 1.17+etch.23etch1 | DSA-1687-1 |
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-23etch1 | DSA-1687-1 |
| Debian 4.0 | linux-2.6.24 | 2.6.24-6~etchnhalf.7 | DSA-1681-1 |
| Debian 4.0 | user-mode-linux | 2.6.18-1um-2etch.23etch1 | DSA-1687-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-92.1.22.el5 | RHSA-2008:1017 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | kernel-rt +9 | 2.6.24.7-93.el5rt | RHSA-2009:0009 |
Advisories 4
- RHSA-2008:1017 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1687-1 fai-kernels linux-2.6 user-mode-linux - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1681-1 linux-2.6.24 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2009:0009 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 35390 third-party-advisory
- 32998 third-party-advisory
- [oss-security] 20081013 CVE request: kernel: don't allow splice() to files opened with O_APPEND mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=466707
- MDVSA-2008:224 vendor-advisory
- oval:org.mitre.oval:def:11142 vdb-entry signature
- linux-kernel-dosplicefrom-security-bypass(45954) vdb-entry
- 31903 vdb-entry
- RHSA-2009:0009 vendor-advisory
- SUSE-SA:2009:030 vendor-advisory
- FEDORA-2008-8929 vendor-advisory
- [oss-security] 20081014 Re: CVE request: kernel: don't allow splice() to files opened with O_APPEND mailing-list
- 33586 third-party-advisory
- DSA-1687 vendor-advisory
- http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git%3Ba=commit%3Bh=efc968d450e013049a662d22727cf132618dcb2f
- 32918 third-party-advisory
- USN-679-1 vendor-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27
- 33180 third-party-advisory
- RHSA-2008:1017 vendor-advisory
- 32386 third-party-advisory
- FEDORA-2008-8980 vendor-advisory
- DSA-1681 vendor-advisory
- 33182 third-party-advisory