CVE-2008-2148: Linux Kernel

Low severity, CVSS 3.6. EPSS: 0.4% chance of exploitation in the next 30 days.

The utimensat system call (sys_utimensat) in Linux kernel 2.6.22 and other versions before 2.6.25.3 does not check file permissions when certain UTIME_NOW and UTIME_OMIT combinations are used, which allows local users to modify file times of arbitrary files, possibly leading to a denial of service.

Affected products

• Linux Linux Kernel: version 2.6.22 only; version 2.6.22.1 only; version 2.6.22.2 only; version 2.6.22.3 only; version 2.6.22.4 only; version 2.6.22.5 only; …

Published 2008-05-12. Last modified 2026-06-16.