Description
The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during use of certain filesystems, which allows local users to cause a denial of service (incorrect free operations and system crash) via an open system call.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 2.6.33-1 | — |
| Debian 13 | linux | 2.6.33-1 | — |
| Debian 12 | linux | 2.6.33-1 | — |
| Debian 6.0 | linux-2.6 | 2.6.32-48squeeze8 | DLA-0015-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perf +16 | 2.6.32-431.20.3.el6 | RHSA-2014:0771 |
Advisories 2
- RHSA-2014:0771 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DLA-0015-1 linux-2.6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- 59262 third-party-advisory
- 68125 vdb-entry
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=86acdca1b63e6890540fa19495cfc708beff3d8b
- 59309 third-party-advisory
- 59406 third-party-advisory
- http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.33
- http://linux.oracle.com/errata/ELSA-2014-0771.html
- 59560 third-party-advisory
- http://linux.oracle.com/errata/ELSA-2014-3043.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1094363
- https://github.com/torvalds/linux/commit/86acdca1b63e6890540fa19495cfc708beff3d8b