CVE-2010-3850

The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2 does not...

2.1 LowPublic exploit

The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2 does not require the CAP_NET_ADMIN capability, which allows local users to bypass intended access restrictions and configure econet addresses via an SIOCSIFADDR ioctl call.

Exploit likelihood

0.83%Down 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 2.1

Record: CVE-2010-3850
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2010-3850
Updated: 2026-11-02

EUVDEUVD-2010-3829 No score

Record: EUVD-2010-3829
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x5q7-74fg-9cp7 No score

The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2 does not...

Record: GHSA-x5q7-74fg-9cp7
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`linux-2.6` Debian:5.0 From an advisory covering 33 CVEs	before 2.6.26-26lenny1, plus listed versions 2.6.26-132.6.26-13lenny22.6.26-13lenny2~bpo40+12.6.26-142.6.26-15 Show 32 moreShow less 2.6.26-15lenny12.6.26-15lenny22.6.26-15lenny32.6.26-15~bpo40+12.6.26-15~bpo40+22.6.26-162.6.26-172.6.26-17lenny12.6.26-17lenny22.6.26-17lenny2~bpo40+12.6.26-17~bpo40+12.6.26-182.6.26-192.6.26-19lenny12.6.26-19lenny22.6.26-19~bpo40+12.6.26-202.6.26-20~bpo40+12.6.26-212.6.26-21lenny12.6.26-21lenny22.6.26-21lenny32.6.26-21lenny42.6.26-21~bpo40+12.6.26-222.6.26-22lenny12.6.26-232.6.26-242.6.26-24lenny12.6.26-252.6.26-25lenny12.6.26-26	2.6.26-26lenny1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Linux Kernel 2.6.37 (RedHat / Ubuntu 10.04) - 'Full-Nelson.c' Local Privilege Escalation	2010-12-07
Exploit-DB	Linux Kernel < 2.6.36.2 (Ubuntu 10.04) - 'Half-Nelson.c' Econet Privilege Escalation	2011-09-05

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2010-3850 is a low vulnerability (CVSS 2.1) in Debian Linux, published November 26, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 57th percentile. No source names a fixed version.

References

Show 14 moreShow less