The futex_wait function in kernel/futex.c in the Linux kernel prior to 2.6.37 does not properly maintain a certain reference count during requeue operations, which allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that triggers a zero count.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
linux linux kernel 2.6.36 |
||
linux linux kernel |
||
linux linux kernel 2.6.36.3 |
||
linux linux kernel 2.6.36.1 |
||
linux linux kernel 2.6.36.2 |
Vulmon