Description
The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exit_signal field and then uses an exec system call to launch a setuid application.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-15lenny2 | DSA-1800-1 |
| Debian 5.0 | user-mode-linux | 2.6.26-1um-2+15lenny2 | DSA-1800-1 |
| Debian 4.0 | fai-kernels | 1.17+etch.24etch2 | DSA-1794-1 |
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-24etch2 | DSA-1794-1 |
| Debian 4.0 | linux-2.6.24 | 2.6.24-6~etchnhalf.8etch1 | DSA-1787-1 |
| Debian 4.0 | user-mode-linux | 2.6.18-1um-2etch.24etch2 | DSA-1794-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-128.1.10.el5 | RHSA-2009:0473 |
| RHEL 4 | kernel +10 | 2.6.9-89.EL | RHSA-2009:1024 |
| RHEL 3 | kernel +8 | 2.4.21-63.EL | RHSA-2009:1550 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4.7 EUS | kernel +10 | 2.6.9-78.0.24.EL | RHSA-2009:1077 |
| Red Hat MRG 1 | kernel-rt +9 | 2.6.24.7-111.el5rt | RHSA-2009:0451 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Linux Kernel < 2.6.29 - 'exit_notify()' Local Privilege Escalation EDB-8369 · local · Apr 8, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 8
- RHSA-2009:1550 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2009:0473 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1077 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1024 Red Hat Security Advisory: Red Hat Enterprise Linux 4.8 kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1787-1 linux-2.6.24 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1794-1 linux-2.6 - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1800-1 linux-2.6 user-mode-linux - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2009:0451 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 35390 third-party-advisory
- MDVSA-2009:135 vendor-advisory
- 20100625 VMSA-2010-0010 ESX 3.5 third party update for Service Console kernel mailing-list
- 35226 third-party-advisory
- SUSE-SA:2009:028 vendor-advisory
- 37471 third-party-advisory
- 35160 third-party-advisory
- FEDORA-2009-5356 vendor-advisory
- SUSE-SA:2009:032 vendor-advisory
- [oss-security] 20090407 CVE request: kernel: exit_notify: kill the wrong capable(CAP_KILL) check mailing-list
- 35656 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- https://bugzilla.redhat.com/show_bug.cgi?id=493771
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=432870dab85a2f69dc417022646cb9a70acf7f94
- DSA-1794 vendor-advisory
- 20090516 rPSA-2009-0084-1 kernel mailing-list
- SUSE-SA:2009:030 vendor-advisory
- [linux-kernel] 20090225 Re: [PATCH 2/2] exit_notify: kill the wrong capable(CAP_KILL) check mailing-list
- 35324 third-party-advisory
- 35185 third-party-advisory
- 35015 third-party-advisory
- http://patchwork.kernel.org/patch/16544/
- oval:org.mitre.oval:def:11206 vdb-entry signature
- 35011 third-party-advisory
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- 35120 third-party-advisory
- SUSE-SA:2009:031 vendor-advisory
- USN-793-1 vendor-advisory
- 34981 third-party-advisory
- DSA-1800 vendor-advisory
- RHSA-2009:1077 vendor-advisory
- 1022141 vdb-entry
- 34405 vdb-entry
- 35387 third-party-advisory
- 34917 third-party-advisory
- RHSA-2009:1550 vendor-advisory
- DSA-1787 vendor-advisory
- RHSA-2009:1024 vendor-advisory
- MDVSA-2009:119 vendor-advisory
- [oss-security] 20090417 Re: CVE request: kernel: exit_notify: kill the wrong capable(CAP_KILL) check mailing-list
- RHSA-2009:0473 vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2009-0084
- http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.30-rc1
- RHSA-2009:0451 vendor-advisory
- oval:org.mitre.oval:def:8295 vdb-entry signature
- 35121 third-party-advisory
- ADV-2009-3316 vdb-entry
- 35394 third-party-advisory
- oval:org.mitre.oval:def:10919 vdb-entry signature