CVE-2007-3731
The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT segment selector in ...
CVE-2007-3731 is a medium vulnerability (CVSS 4.9) in Linux Kernel, published September 17, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in linux-2.6 2.6.18.dfsg.1-13etch3.
The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT segment selector in %cs (the xcs field) during ptrace single-step operations, which allows local users to cause a denial of service (NULL dereference and OOPS) via certain code that makes ptrace PTRACE_SETREGS and PTRACE_SINGLESTEP requests, related to the TRACE_IRQS_ON function, and possibly related to the arch_ptrace function.
Exploit likelihood
What each source reports
NVD Score used
The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT segment selector in %cs (the xcs field) during ptrace single-step operations, which allows local users to cause a denial of service (NULL dereference and OOPS) via certain code that makes ptrace PTRACE_SETREGS and PTRACE_SINGLESTEP requests, related to the TRACE_IRQS_ON function, and possibly related to the arch_ptrace function.
- Record
CVE-2007-3731- CVSS 2.0
- 4.9 Medium
AV:L/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT segment selector in %cs (the xcs field) during ptrace single-step operations, which allows local users to cause a denial of service (NULL dereference and OOPS) via certain code that makes ptrace PTRACE_SETREGS and PTRACE_SINGLESTEP requests, related to the TRACE_IRQS_ON function, and possibly related to the arch_ptrace function.
- Record
CVE-2007-3731- Updated
- 2026-11-02
EUVDEUVD-2007-3715 No score
The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT segment selector in %cs (the xcs field) during ptrace single-step operations, which allows local users to cause a denial of service (NULL dereference and OOPS) via certain code that makes ptrace PTRACE_SETREGS and PTRACE_SINGLESTEP requests, related to the TRACE_IRQS_ON function, and possibly related to the arch_ptrace function.
- Record
EUVD-2007-3715- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-frx9-99ch-7q7j No score
The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT segment selector in ...
The Linux kernel 2.6.20 and 2.6.21 does not properly handle an invalid LDT segment selector in %cs (the xcs field) during ptrace single-step operations, which allows local users to cause a denial of service (NULL dereference and OOPS) via certain code that makes ptrace PTRACE_SETREGS and PTRACE_SINGLESTEP requests, related to the TRACE_IRQS_ON function, and possibly related to the arch_ptrace function.
- Record
GHSA-frx9-99ch-7q7j- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
linux-2.6Debian:4.0 |
before 2.6.18.dfsg.1-13etch3, plus listed versions 2.6.18.dfsg.1-122.6.18.dfsg.1-12etch12.6.18.dfsg.1-12etch22.6.18.dfsg.1-132.6.18.dfsg.1-13etch12.6.18.dfsg.1-13etch2 |
2.6.18.dfsg.1-13etch3 |
fai-kernelsDebian:4.0 |
before 1.17+etch.13etch3, plus listed versions 1.171.17+etch11.17+etch21.17+etch31.17+etch41.17+etch51.17etch1 |
1.17+etch.13etch3 |
user-mode-linuxDebian:4.0 |
before 2.6.18-1um-2etch.13etch3, plus listed versions 2.6.18-1um-22.6.18-1um-2etch12.6.18-1um-2etch22.6.18-1um-2etch32.6.18-1um-2etch4 |
2.6.18-1um-2etch.13etch3 |
kernelRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-PAERed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-PAE-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-PAE-develRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-debuginfo-commonRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-develRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kernel-docRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-xenRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-xen-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-xen-develRed Hat:enterprise_linux:5::client |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernelRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-PAERed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-PAE-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-PAE-develRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-debuginfo-commonRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-develRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-docRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-kdumpRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-kdump-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-kdump-develRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-xenRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-xen-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
kernel-xen-develRed Hat:enterprise_linux:5::server |
before 0:2.6.18-8.1.15.el5 | 0:2.6.18-8.1.15.el5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected, aliases, facts, references, title | GitHub Advisories, OSV |
| 2026-11-02 | created | CVE List, NVD |
References
securityfocus.com/bid/25801
bugzilla.kernel.org/show_bug.cgi?id=8765
git.kernel.org?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=a10d9a71bafd3a283da240d2868e71346d2aef6f
osvdb.org/37286
redhat.com/support/errata/RHSA-2007-0940.html
secunia.com/advisories/29159
Show 54 moreShow less
wiki.rpath.com/wiki/Advisories:rPSA-2008-0094
issues.rpath.com/browse/RPL-2304
ubuntu.com/usn/usn-518-1
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10394
bugzilla.redhat.com/show_bug.cgi?id=248324
debian.org/security/2007/dsa-1378
nvd.nist.gov/vuln/detail/CVE-2007-3731
access.redhat.com/errata/RHSA-2007:0940
github.com/advisories/GHSA-frx9-99ch-7q7j
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0940.json
cve.org/CVERecord?id=CVE-2007-3105