Description
The xfs_ioc_fsgetxattr function in fs/xfs/linux-2.6/xfs_ioctl.c in the Linux kernel before 2.6.36-rc4 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an ioctl call.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-25lenny1 | DSA-2110-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perf +14 | 2.6.32-71.14.1.el6 | RHSA-2011:0007 |
| RHEL 5 | kernel +12 | 2.6.18-194.26.1.el5 | RHSA-2010:0839 |
Advisories 3
- RHSA-2011:0007 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2010:0839 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2110-1 linux-2.6 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20100907 CVE request: kernel: xfs: XFS_IOC_FSGETXATTR ioctl memory leak mailing-list
- USN-1000-1 vendor-advisory
- SUSE-SA:2010:041 vendor-advisory
- [xfs-masters] 20100906 [PATCH] xfs: prevent reading uninitialized stack memory mailing-list
- 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console mailing-list
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a122eb2fdfd78b58c6dd992d6f4b1aaef667eef9
- 46397 third-party-advisory
- RHSA-2011:0007 vendor-advisory
- ADV-2010-2430 vdb-entry
- SUSE-SA:2011:007 vendor-advisory
- ADV-2011-0298 vdb-entry
- SUSE-SA:2010:050 vendor-advisory
- RHSA-2010:0839 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2011-0012.html
- [oss-security] 20100907 Re: CVE request: kernel: xfs: XFS_IOC_FSGETXATTR ioctl memory leak mailing-list
- 42890 third-party-advisory
- 1024418 vdb-entry
- 41284 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=630804
- http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.36-rc4
- SUSE-SA:2010:054 vendor-advisory
- 43022 vdb-entry
- 41512 third-party-advisory