{"id":"CVE-2010-2226","aliases":["DSA-2094-1","EUVD-2010-2242","GHSA-2fg3-h938-jr6f","RHSA-2010:0610"],"status":"published","title":"The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not...","description":"The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file.","severity":{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00434,"percentile":0.37963,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2010-08-19T00:00:00Z","modified":"2026-06-26T12:20:36Z","affected":[{"source":"osv","ecosystem":"Debian:5.0","package":"linux-2.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.26-24lenny1"}]}],"versions":["2.6.26-13","2.6.26-13lenny2","2.6.26-13lenny2~bpo40+1","2.6.26-14","2.6.26-15","2.6.26-15lenny1","2.6.26-15lenny2","2.6.26-15lenny3","2.6.26-15~bpo40+1","2.6.26-15~bpo40+2","2.6.26-16","2.6.26-17","2.6.26-17lenny1","2.6.26-17lenny2","2.6.26-17lenny2~bpo40+1","2.6.26-17~bpo40+1","2.6.26-18","2.6.26-19","2.6.26-19lenny1","2.6.26-19lenny2","2.6.26-19~bpo40+1","2.6.26-20","2.6.26-20~bpo40+1","2.6.26-21","2.6.26-21lenny1","2.6.26-21lenny2","2.6.26-21lenny3","2.6.26-21lenny4","2.6.26-21~bpo40+1","2.6.26-22","2.6.26-22lenny1","2.6.26-23","2.6.26-24"],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-PAE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-PAE-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-PAE-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-xen-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"kernel-xen-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-PAE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-PAE-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-PAE-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-debuginfo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-kdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-kdump-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-kdump-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-xen-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"kernel-xen-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.18-194.11.1.el5"}]}],"bundled":7}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"linux","product":"linux_kernel"},{"vendor":"suse","product":"linux_enterprise_desktop"},{"vendor":"suse","product":"linux_enterprise_server"},{"vendor":"suse","product":"linux_enterprise_software_development_kit"}],"references":[{"url":"http://www.redhat.com/support/errata/RHSA-2010-0610.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory"]},{"url":"http://archives.free.net.ph/message/20100616.135735.40f53a32.en.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Broken Link"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1817176a86352f65210139d4c794ad2d19fc6b63","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.ubuntu.com/usn/USN-1000-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory"]},{"url":"http://marc.info/?l=oss-security\u0026m=127687486331790\u0026w=2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:198","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=605158","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35","tags":["x_refsource_CONFIRM","x_transferred","Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0298","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory"]},{"url":"http://marc.info/?l=oss-security\u0026m=127677135609357\u0026w=2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory"]},{"url":"http://secunia.com/advisories/43315","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://archives.free.net.ph/message/20100616.130710.301704aa.en.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Broken Link"]},{"url":"http://www.debian.org/security/2010/dsa-2094","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2011-0003.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/40920","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/archive/1/516397/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2226","tags":["advisory"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1817176a86352f65210139d4c794ad2d19fc6b63"},{"url":"https://github.com/advisories/GHSA-2fg3-h938-jr6f"},{"url":"https://access.redhat.com/errata/RHSA-2010:0610","tags":["advisory"]},{"url":"http://www.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.5_Technical_Notes/kernel.html#id3512211","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=576018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=586415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=601006","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=607483","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=607486","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=608583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=612028","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=612166","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=612539","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=613688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=613900","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=615260","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0610.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-1084","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-1084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-1084","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-2066","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-2066","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2066","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-2070","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-2070","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2070","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-2226","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-2226","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-2248","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-2248","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2248","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-2521","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-2521","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2521","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2010-2524","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-2524","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2524","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2010-2226","description":"The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file.","status":"published","published":"2010-09-03T19:00:00Z","modified":"2024-08-07T02:25:07.361Z","updated_at":"2026-11-02T14:33:26.665532Z"}],"euvd":[{"id":"EUVD-2010-2242","description":"The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file.","status":"published","published":"2010-09-03T19:00:00Z","modified":"2024-08-07T02:25:07Z","updated_at":"2026-11-03T01:39:38.386309Z"}],"ghsa":[{"id":"GHSA-2fg3-h938-jr6f","title":"The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not...","description":"The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file.","status":"published","published":"2022-05-13T01:24:25Z","modified":"2023-02-13T06:32:17Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:54:07.010181Z"}],"nvd":[{"id":"CVE-2010-2226","description":"The xfs_swapext function in fs/xfs/xfs_dfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file.","status":"published","published":"2010-09-03T20:00:03.34Z","modified":"2026-06-16T23:20:20.113Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:01:52.227027Z"}],"osv":[{"id":"DSA-2094-1","title":"linux-2.6 - several issues","status":"published","published":"2010-08-19T00:00:00Z","modified":"2026-03-09T01:01:09.29242Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"RHSA-2010:0610","title":"Red Hat Security Advisory: kernel security and bug fix update","status":"published","published":"2024-09-15T18:33:00Z","modified":"2026-06-26T12:20:36.872566946Z","updated_at":"2026-11-02T15:53:01.003286Z"}]}}