CVE-2005-4886 in Linux
Summary
by MITRE
The selinux_parse_skb_ipv6 function in security/selinux/hooks.c in the Linux kernel before 2.6.12-rc4 allows remote attackers to cause a denial of service (OOPS) via vectors associated with an incorrect call to the ipv6_skip_exthdr function.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/01/2026
The vulnerability identified as CVE-2005-4886 represents a critical flaw in the Linux kernel's Security-Enhanced Linux (SELinux) implementation that affects systems running kernel versions prior to 2.6.12-rc4. This issue manifests within the selinux_parse_skb_ipv6 function located in the security/selinux/hooks.c file, which handles network packet processing for IPv6 traffic. The vulnerability arises from an incorrect function call pattern that leads to kernel oops conditions, effectively causing system instability and potential denial of service scenarios. The flaw specifically impacts the handling of IPv6 extension headers during network packet inspection, creating a scenario where malformed or specially crafted packets can trigger kernel memory corruption.
The technical root cause of this vulnerability stems from improper parameter handling when invoking the ipv6_skip_exthdr function within the SELinux packet filtering context. This function call error results in incorrect pointer arithmetic and memory access patterns that can lead to kernel panic conditions or system crashes. The vulnerability demonstrates characteristics consistent with a buffer over-read or improper memory dereference issue, where the kernel attempts to process IPv6 packets with malformed extension header structures. This type of flaw falls under the CWE-125 vulnerability category, which encompasses out-of-bounds read errors in kernel space, and represents a classic example of improper input validation in network protocol handling code. The attack vector requires remote exploitation through network traffic, making it particularly dangerous for systems exposed to untrusted network environments.
The operational impact of CVE-2005-4886 extends beyond simple denial of service to potentially compromise system stability and availability in production environments. When exploited, the vulnerability can cause kernel oops conditions that result in system crashes, requiring manual intervention and system restarts to restore normal operations. This vulnerability is particularly concerning for network infrastructure devices, servers, and any system that processes IPv6 traffic through SELinux-enabled security policies. The exploitability factor is relatively high since it only requires sending specially crafted IPv6 packets to the target system, making it an attractive target for attackers seeking to disrupt services. Systems running affected kernel versions are vulnerable to both intentional attacks and accidental crashes that could occur during normal network operations, particularly in environments where IPv6 traffic is processed through SELinux policies.
Mitigation strategies for this vulnerability focus on immediate kernel version upgrades to 2.6.12-rc4 or later, where the problematic function call has been corrected. Organizations should prioritize patch management processes to ensure all systems running SELinux-enabled kernels are updated promptly. Additionally, network administrators can implement temporary workarounds such as disabling IPv6 processing for SELinux policies or configuring network filters to drop suspicious IPv6 packets. The vulnerability aligns with ATT&CK technique T1499.004, which covers network disruption attacks through kernel-level vulnerabilities, and represents a critical target for defensive measures. Security monitoring should include detection of kernel oops events and unusual network traffic patterns that might indicate exploitation attempts. Organizations should also review their SELinux policy configurations to ensure minimal exposure while maintaining security posture, as this vulnerability demonstrates how security modules can introduce additional attack surfaces when not properly validated against network protocol handling functions.