CVE-2008-4302: Debian Linux

Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days.

fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru function, and subsequently attempts to unlock a page that was not locked, which allows local users to cause a denial of service (kernel BUG and system crash), as demonstrated by the fio I/O tool.

Affected products

• Debian Debian Linux: version 4.0 only
• Linux Linux Kernel: before 2.6.22.2 (fixed in 2.6.22.2)
• Red Hat Enterprise Linux: version 5.0 only

Published 2008-09-29. Last modified 2026-06-16.