Description
The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-24lenny1 | DSA-2094-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-194.11.1.el5 | RHSA-2010:0610 |
Advisories 2
- RHSA-2010:0610 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2094-1 linux-2.6 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2010:0610 vendor-advisory
- [xfs] 20100616 Re: [Security] XFS swapext ioctl minor security issues mailing-list
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1817176a86352f65210139d4c794ad2d19fc6b63
- USN-1000-1 vendor-advisory
- [oss-security] 20100618 Re: CVE request - kernel: xfs swapext ioctl issue mailing-list
- MDVSA-2010:198 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=605158
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35
- SUSE-SA:2011:007 vendor-advisory
- SUSE-SA:2010:060 vendor-advisory
- ADV-2011-0298 vdb-entry
- [oss-security] 20100617 CVE request - kernel: xfs swapext ioctl issue mailing-list
- 43315 third-party-advisory
- [xfs] 20100616 Re: [Security] XFS swapext ioctl minor security issues mailing-list
- DSA-2094 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- 40920 vdb-entry
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list