CVE-2006-1864
Directory traversal vulnerability in smbfs in Linux 2.6.16 and earlier allows local users to...
4.6 MediumPublic exploitFix available
CVE-2006-1864 is a medium vulnerability (CVSS 4.6) in Linux Kernel, published April 26, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 67th percentile. Fixed in kernel-source-2.4.27 2.4.27-10sarge3.
Directory traversal vulnerability in smbfs in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\" sequences, a similar vulnerability to CVE-2006-1863.
Exploit likelihood
1.19%Down 2.8 points since Feb 4, 2022
What each source reports
NVD Score used
Directory traversal vulnerability in smbfs in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\" sequences, a similar vulnerability to CVE-2006-1863.
- Record
CVE-2006-1864- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in smbfs in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\" sequences, a similar vulnerability to CVE-2006-1863.
- Record
CVE-2006-1864- Updated
- 2026-11-02
EUVDEUVD-2006-1864 No score
Directory traversal vulnerability in smbfs in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\" sequences, a similar vulnerability to CVE-2006-1863.
- Record
EUVD-2006-1864- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fmc8-hp9q-fhj5 No score
Directory traversal vulnerability in smbfs in Linux 2.6.16 and earlier allows local users to...
Directory traversal vulnerability in smbfs in Linux 2.6.16 and earlier allows local users to escape chroot restrictions for an SMB-mounted filesystem via "..\" sequences, a similar vulnerability to CVE-2006-1863.
- Record
GHSA-fmc8-hp9q-fhj5- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kernel-source-2.4.27Debian:3.1 |
before 2.4.27-10sarge3, plus listed versions 2.4.27-102.4.27-10sarge12.4.27-10sarge2 |
2.4.27-10sarge3 |
kernel-source-2.6.8Debian:3.1 |
before 2.6.8-16sarge3, plus listed versions 2.6.8-162.6.8-16sarge12.6.8-16sarge2 |
2.6.8-16sarge3 |
kernelRed Hat:enterprise_linux:4::as |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-debuginfoRed Hat:enterprise_linux:4::as |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-develRed Hat:enterprise_linux:4::as |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-docRed Hat:enterprise_linux:4::as |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-hugememRed Hat:enterprise_linux:4::as |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-hugemem-develRed Hat:enterprise_linux:4::as |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-largesmpRed Hat:enterprise_linux:4::as |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-largesmp-develRed Hat:enterprise_linux:4::as |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
Show 72 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kernel-smpRed Hat:enterprise_linux:4::as |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-smp-develRed Hat:enterprise_linux:4::as |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernelRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-develRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-docRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-hugememRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-hugemem-develRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-largesmpRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-largesmp-develRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-smpRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-smp-develRed Hat:enterprise_linux:4::desktop |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernelRed Hat:enterprise_linux:4::es |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-debuginfoRed Hat:enterprise_linux:4::es |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-develRed Hat:enterprise_linux:4::es |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-docRed Hat:enterprise_linux:4::es |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-hugememRed Hat:enterprise_linux:4::es |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-hugemem-develRed Hat:enterprise_linux:4::es |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-largesmpRed Hat:enterprise_linux:4::es |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-largesmp-develRed Hat:enterprise_linux:4::es |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-smpRed Hat:enterprise_linux:4::es |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-smp-develRed Hat:enterprise_linux:4::es |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernelRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-develRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-docRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-hugememRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-hugemem-develRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-largesmpRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-largesmp-develRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-smpRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernel-smp-develRed Hat:enterprise_linux:4::ws |
before 0:2.6.9-34.0.1.EL | 0:2.6.9-34.0.1.EL |
kernelRed Hat:enterprise_linux:3::as |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-BOOTRed Hat:enterprise_linux:3::as |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-debuginfoRed Hat:enterprise_linux:3::as |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-docRed Hat:enterprise_linux:3::as |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-hugememRed Hat:enterprise_linux:3::as |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-hugemem-unsupportedRed Hat:enterprise_linux:3::as |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-smpRed Hat:enterprise_linux:3::as |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-smp-unsupportedRed Hat:enterprise_linux:3::as |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-sourceRed Hat:enterprise_linux:3::as |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-unsupportedRed Hat:enterprise_linux:3::as |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernelRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-BOOTRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-docRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-hugememRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-hugemem-unsupportedRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-smpRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-smp-unsupportedRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-sourceRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-unsupportedRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernelRed Hat:enterprise_linux:3::es |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-BOOTRed Hat:enterprise_linux:3::es |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-debuginfoRed Hat:enterprise_linux:3::es |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-docRed Hat:enterprise_linux:3::es |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-hugememRed Hat:enterprise_linux:3::es |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-hugemem-unsupportedRed Hat:enterprise_linux:3::es |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-smpRed Hat:enterprise_linux:3::es |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-smp-unsupportedRed Hat:enterprise_linux:3::es |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-sourceRed Hat:enterprise_linux:3::es |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-unsupportedRed Hat:enterprise_linux:3::es |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernelRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-BOOTRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-docRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-hugememRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-hugemem-unsupportedRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-smpRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-smp-unsupportedRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-sourceRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
kernel-unsupportedRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-47.0.1.EL | 0:2.4.21-47.0.1.EL |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Linux Kernel 2.6.x - SMBFS CHRoot Security Restriction Bypass | 2006-04-28 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
support.avaya.com/elmodocs2/security/ASA-2006-161.htm
redhat.com/support/errata/RHSA-2006-0493.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11327
secunia.com/advisories/19869
vupen.com/english/advisories/2006/4502
Show 150 moreShow less
osvdb.org/25067
mandriva.com/security/advisories?name=MDKSA-2006:150
vmware.com/download/esx/esx-202-200610-patch.html
ubuntu.com/usn/usn-302-1
securityfocus.com/archive/1/451426/100/200/threaded
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189435
debian.org/security/2006/dsa-1097
novell.com/linux/security/advisories/2006-05-31.html
trustix.org/errata/2006/0026
exchange.xforce.ibmcloud.com/vulnerabilities/26137
nvd.nist.gov/vuln/detail/CVE-2006-1864
github.com/advisories/GHSA-fmc8-hp9q-fhj5
access.redhat.com/errata/RHSA-2006:0493
security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0493.json
cve.org/CVERecord?id=CVE-2005-2973