Description
The USB subsystem in the Linux kernel before 2.6.36-rc5 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to TIOCGICOUNT ioctl calls, and the (1) mos7720_ioctl function in drivers/usb/serial/mos7720.c and (2) mos7840_ioctl function in drivers/usb/serial/mos7840.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-26lenny1 | DSA-2126-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perf +14 | 2.6.32-71.14.1.el6 | RHSA-2011:0007 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | perf +10 | 2.6.33.7-rt29.47.el5rt | RHSA-2010:0958 |
Advisories 3
- RHSA-2011:0007 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2010:0958 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2126-1 linux-2.6 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a0846f1868b11cd827bdfeaf4527d8b1b1c0b098
- [oss-security] 20100925 CVE request: multiple kernel stack memory disclosures mailing-list
- http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.36/ChangeLog-2.6.36-rc5
- [oss-security] 20101006 Re: CVE request: multiple kernel stack memory disclosures mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=648659
- RHSA-2011:0007 vendor-advisory
- [linux-kernel] 20100915 [PATCH] drivers/usb/serial/mos*: prevent reading uninitialized stack memory mailing-list
- RHSA-2010:0958 vendor-advisory
- [oss-security] 20101006 Re: CVE request: multiple kernel stack memory disclosures mailing-list
- 45074 vdb-entry
- 42890 third-party-advisory
- [oss-security] 20101025 Re: CVE request: multiple kernel stack memory disclosures mailing-list
- DSA-2126 vendor-advisory