Description
fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial of service (memory consumption) via a crafted exec system call, aka an "OOM dodging issue," a related issue to CVE-2010-3858.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-26lenny2 | DSA-2153-1 |
| Debian 5.0 | user-mode-linux | 2.6.26-1um-2+26lenny2 | DSA-2153-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perf +14 | 2.6.32-71.18.1.el6 | RHSA-2011:0283 |
| RHEL 5 | kernel +12 | 2.6.18-238.el5 | RHSA-2011:0017 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | kernel-rt +10 | 2.6.33.9-rt31.75.el6rt | RHSA-2011:1253 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Linux Kernel 2.6.37 - 'setup_arg_pages()' Denial of Service EDB-15619 · dos · Nov 26, 2010
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2011:1253 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:0017 Red Hat Security Advisory: Red Hat Enterprise Linux 5.6 kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:0283 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2153-1 linux-2.6 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20101122 CVE request: kernel: mm: mem allocated invisible to oom_kill() when not attached to any threads mailing-list
- 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console mailing-list
- RHSA-2011:0017 vendor-advisory
- 46397 third-party-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.37
- https://bugzilla.redhat.com/show_bug.cgi?id=625688
- linux-kernel-execve-dos(64700) vdb-entry
- [linux-kernel] 20100830 Re: [PATCH] exec argument expansion can inappropriately trigger OOM-killer mailing-list
- 15619 exploit
- [linux-kernel] 20101130 [PATCH 1/2] exec: make argv/envp memory visible to oom-killer mailing-list
- [oss-security] 20101122 Re: CVE request: kernel: mm: mem allocated invisible to oom_kill() when not attached to any threads mailing-list
- http://www.vmware.com/security/advisories/VMSA-2011-0012.html
- 42884 third-party-advisory
- [linux-kernel] 20100827 [PATCH] exec argument expansion can inappropriately trigger OOM-killer mailing-list
- [linux-kernel] 20100830 Re: [PATCH] exec argument expansion can inappropriately trigger OOM-killer mailing-list
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3c77f845722158206a7209c45ccddc264d19319c
- http://grsecurity.net/~spender/64bit_dos.c
- [linux-kernel] 20100830 Re: [PATCH] exec argument expansion can inappropriately trigger OOM-killer mailing-list
- 45004 vdb-entry