CVE-2012-1097

Description

The regset (aka register set) feature in the Linux kernel before 3.2.10 does not properly handle the absence of .get and .set methods, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a (1) PTRACE_GETREGSET or (2) PTRACE_SETREGSET ptrace call.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 6.0	linux-2.6	2.6.32-41squeeze2	DSA-2443-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 6	perf +15	2.6.32-220.13.1.el6	RHSA-2012:0481

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 6.1 EUS	perf +14	2.6.32-131.29.1.el6	RHSA-2012:1042

Advisories 3

RHSA-2012:0481 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
DSA-2443-1 linux-2.6 - several Debian Security (DSA / DLA) · Mar 9, 2026
RHSA-2012:1042 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025

References

RHSA-2012:0531 vendor-advisory
SUSE-SU-2012:0554 vendor-advisory
48898 third-party-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=799209
RHSA-2012:0481 vendor-advisory
[oss-security] 20120305 CVE-2012-1097 kernel: regset: Prevent null pointer reference on readonly regsets mailing-list
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.10
48964 third-party-advisory
https://github.com/torvalds/linux/commit/c8e252586f8d5de906385d8cf6385fee289a825e
SUSE-SU-2012:0616 vendor-advisory
48842 third-party-advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c8e252586f8d5de906385d8cf6385fee289a825e