Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Linux kernel FTDI serial driver can exhaust memory

CVE-2006-2936 · published 20 years ago
Summary

The FTDI USB-to-serial driver in Linux kernel versions up to 2.6.17 may let a user who can write to the serial port fill the driver’s queue faster than the hardware can process it, causing the system to use excessive memory. This can lead to slowdowns or a crash for anyone using the machine. Update the kernel to a newer version or restrict write access to the FTDI serial device to prevent the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
linux linux_kernel 2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.8.1
2.6.9
2.6.10
75 more version ranges
cpe:2.3:o:linux:linux_kernel:2.6.0:*:*:*:*:*:*:*
Original advisory text
The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to 2.6.17, and possibly later versions, allows local users to cause a denial of service (memory consumption) by writing more dat...
The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to 2.6.17, and possibly later versions, allows local users to cause a denial of service (memory consumption) by writing more data to the serial port than the hardware can handle, which causes the data to be queued.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.8 High
Exploitation
3% chance of attack within 30 days
Type
CWE-399Resource Management Errors
Timeline
Published10 Jul 2006
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2006-2936 · NVD
Track software like this
Free during beta