Description
The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly earlier versions, when the UTF-8 console is used, allows physically proximate attackers to cause a denial of service (memory corruption) by selecting a small number of 3-byte UTF-8 characters, which triggers an "off-by-two memory error." NOTE: it is not clear whether this issue crosses privilege boundaries.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-15lenny2 | DSA-1800-1 |
| Debian 5.0 | user-mode-linux | 2.6.26-1um-2+15lenny2 | DSA-1800-1 |
| Debian 4.0 | linux-2.6.24 | 2.6.24-6~etchnhalf.8etch1 | DSA-1787-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | kernel-rt +9 | 2.6.24.7-111.el5rt | RHSA-2009:0451 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Linux Kernel 2.6.24_16-23/2.6.27_7-10/2.6.28.3 (Ubuntu 8.04/8.10 / Fedora Core 10 x86-64) - 'set_selection()' UTF-8 Off-by-One Privilege Escalation EDB-9083 · local · Jul 9, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- DSA-1787-1 linux-2.6.24 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1800-1 linux-2.6 user-mode-linux - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2009:0451 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.4
- [oss-security] 20090212 http://www.securityfocus.com/bid/33672/info kernel issue mailing-list
- [oss-security] 20090212 Re: http://www.securityfocus.com/bid/33672/info kernel mailing-list
- 33672 vdb-entry
- USN-751-1 vendor-advisory
- [linux-kernel] 20090202 Re: [PATCH] Fix memory corruption in console selection mailing-list
- 34981 third-party-advisory
- DSA-1800 vendor-advisory
- [oss-security] 20090212 Re: http://www.securityfocus.com/bid/33672/info kernel issue mailing-list
- 34917 third-party-advisory
- DSA-1787 vendor-advisory
- RHSA-2009:0451 vendor-advisory
- [linux-kernel] 20090130 [PATCH] Fix memory corruption in console selection mailing-list
- 35121 third-party-advisory