The (1) real_lookup and (2) __lookup_hash functions in fs/namei.c in the vfs implementation in the Linux kernel before 2.6.25.15 do not prevent creation of a child dentry for a deleted (aka S_DEAD) directory, which allows local users to cause a denial of service ("overflow" of the UBIFS orphan area) via a series of attempted file creations within deleted directories.

The (1) real_lookup and (2) __lookup_hash functions in fs/namei.c in the vfs implementation in the Linux kernel before 2.6.25.15 do not prevent creation of a child dentry for a deleted (aka S_DEAD) directory, which allows local users to cause a denial of service ("overflow" of the UBIFS orphan area) via a series of attempted file creations within deleted directories.

kernel: Local DoS with corrupted ELF kernel Race condition in mincore can cause "ps -ef" to hang fib_semantics.c out of bounds access vulnerability Privilege escalation via PR_SET_PDEATHSIG kernel: Missing ioctl() permission checks in aacraid driver Linux Kernel isdn_net_setcfg buffer overflow I4L: fix isdn_ioctl memory issue Issue with core dump owner kernel: insufficient range checks in fault handlers with mremap kernel: sit memory leak Linux kernel local filesystem DoS kernel: missing capability checks in sbni_ioctl() kernel: open() call allows setgid bit when user is not in new file's group