CVE-2007-2172: Canonical Ubuntu Linux

Medium severity, CVSS 4.7. EPSS: 0.4% chance of exploitation in the next 30 days.

A typo in Linux kernel 2.6 before 2.6.21-rc6 and 2.4 before 2.4.35 causes RTA_MAX to be used as an array size instead of RTN_MAX, which leads to an "out of bound access" by the (1) dn_fib_props (dn_fib.c, DECNet) and (2) fib_props (fib_semantics.c, IPv4) functions.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 6.10 only; version 7.04 only
• Debian Debian Linux: version 3.1 only; version 4.0 only
• Linux Linux Kernel: from 2.4.0, before 2.4.35 (fixed in 2.4.35); from 2.6.0, up to and including 2.6.20; version 2.6.21 only

Published 2007-04-22. Last modified 2026-06-16.