Description
The clone system call in the Linux kernel 2.6.28 and earlier allows local users to send arbitrary signals to a parent process from an unprivileged child process by launching an additional child process with the CLONE_PARENT flag, and then letting this new process exit.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-15lenny2 | DSA-1800-1 |
| Debian 5.0 | user-mode-linux | 2.6.26-1um-2+15lenny2 | DSA-1800-1 |
| Debian 4.0 | fai-kernels | 1.17+etch.24etch2 | DSA-1794-1 |
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-24etch2 | DSA-1794-1 |
| Debian 4.0 | linux-2.6.24 | 2.6.24-6~etchnhalf.8etch1 | DSA-1787-1 |
| Debian 4.0 | user-mode-linux | 2.6.18-1um-2etch.24etch2 | DSA-1794-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-128.1.6.el5 | RHSA-2009:0326 |
| RHEL 4 | kernel +10 | 2.6.9-78.0.22.EL | RHSA-2009:0459 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | kernel-rt +9 | 2.6.24.7-111.el5rt | RHSA-2009:0451 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Linux Kernel 2.6.x - Cloned Process 'CLONE_PARENT' Local Origin Validation EDB-32815 · dos · Feb 25, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2009:0326 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2009:0459 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1787-1 linux-2.6.24 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1794-1 linux-2.6 - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1800-1 linux-2.6 user-mode-linux - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2009:0451 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 35390 third-party-advisory
- RHSA-2009:0326 vendor-advisory
- 34962 third-party-advisory
- MDVSA-2009:118 vendor-advisory
- SUSE-SA:2009:010 vendor-advisory
- 37471 third-party-advisory
- RHSA-2009:0459 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- oval:org.mitre.oval:def:11187 vdb-entry signature
- https://bugzilla.redhat.com/show_bug.cgi?id=479932
- DSA-1794 vendor-advisory
- 20090516 rPSA-2009-0084-1 kernel mailing-list
- 33758 third-party-advisory
- 33906 vdb-entry
- SUSE-SA:2009:030 vendor-advisory
- USN-751-1 vendor-advisory
- 35011 third-party-advisory
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- 35120 third-party-advisory
- SUSE-SA:2009:031 vendor-advisory
- oval:org.mitre.oval:def:7947 vdb-entry signature
- 34033 third-party-advisory
- 34981 third-party-advisory
- DSA-1800 vendor-advisory
- http://scarybeastsecurity.blogspot.com/2009/02/linux-kernel-minor-signal-vulnerability.html
- 34917 third-party-advisory
- DSA-1787 vendor-advisory
- 52204 vdb-entry
- http://wiki.rpath.com/Advisories:rPSA-2009-0084
- RHSA-2009:0451 vendor-advisory
- 35121 third-party-advisory
- 34680 third-party-advisory
- ADV-2009-3316 vdb-entry
- 35394 third-party-advisory
- http://scary.beasts.org/security/CESA-2009-002.html