CVE-2016-3699
The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when...
7.4 High
The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
0.50%Down 0.6 points since Feb 4, 2022
What each source reports
NVD Score used
The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd.
- Record
CVE-2016-3699- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd.
- Record
CVE-2016-3699- Updated
- 2026-11-02
EUVDEUVD-2016-4720No score
The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd.
- Record
EUVD-2016-4720- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pv5f-x9r7-h4c8
The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when...
The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd.
- Record
GHSA-pv5f-x9r7-h4c8- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2016:2574
Red Hat Security Advisory: kernel security, bug fix, and enhancement update
- Record
RHSA-2016:2574- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
OSVRHSA-2016:2584
Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update
- Record
RHSA-2016:2584- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-13
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kernel-debug-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debuginfo-common-x86_64Red Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-tools-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-tools-libs-develRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
perf-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
python-perf-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernelRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-abi-whitelistsRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debugRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
Show 86 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kernel-debug-develRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-develRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-docRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-headersRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-toolsRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-tools-libsRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
perfRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
python-perfRed Hat:enterprise_linux:7::client From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debug-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debuginfo-common-x86_64Red Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-tools-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-tools-libs-develRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
perf-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
python-perf-debuginfoRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernelRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-abi-whitelistsRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debugRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debug-develRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-develRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-docRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-headersRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-toolsRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-tools-libsRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
perfRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
python-perfRed Hat:enterprise_linux:7::computenode From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debug-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debug-develRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debuginfo-common-ppc64Red Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debuginfo-common-ppc64leRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debuginfo-common-x86_64Red Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-tools-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-tools-libs-develRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
perf-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
python-perf-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernelRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-abi-whitelistsRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-bootwrapperRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debugRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debuginfo-common-s390xRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-develRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-docRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-headersRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-kdumpRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-kdump-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-kdump-develRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-toolsRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-tools-libsRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
perfRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
python-perfRed Hat:enterprise_linux:7::server From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debug-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debuginfo-common-x86_64Red Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-tools-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-tools-libs-develRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
perf-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
python-perf-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernelRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-abi-whitelistsRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debugRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-debug-develRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-develRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-docRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-headersRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-toolsRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-tools-libsRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
perfRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
python-perfRed Hat:enterprise_linux:7::workstation From an advisory covering 34 CVEs | before 0:3.10.0-514.el7 | 0:3.10.0-514.el7 |
kernel-rtRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-debugRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-debug-debuginfoRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-debug-develRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-debug-kvmRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-debug-kvm-debuginfoRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-debuginfoRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-debuginfo-common-x86_64Red Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-develRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-docRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-kvmRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-kvm-debuginfoRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-traceRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-trace-debuginfoRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-trace-develRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-trace-kvmRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
kernel-rt-trace-kvm-debuginfoRed Hat:rhel_extras_rt:7 From an advisory covering 27 CVEs | before 0:3.10.0-514.rt56.420.el7 | 0:3.10.0-514.rt56.420.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-3699 is a high vulnerability (CVSS 7.4) in Linux Kernel, published October 7, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. No source names a fixed version.
References
bugzilla.redhat.com/show_bug.cgi?id=1329653
github.com/mjg59/linux/commit/a4a5ed2835e8ea042868b7401dced3f517cafa76
openwall.com/lists/oss-security/2016/09/22/4
rhn.redhat.com/errata/RHSA-2016-2584.html
securityfocus.com/bid/93114
Show 180 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-3699
access.redhat.com/errata/RHSA-2016:2574
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2574.json
cve.org/CVERecord?id=CVE-2013-4312
seclists.org/oss-sec/2016/q1/194
lkml.org/lkml/2016/2/13/11
comments.gmane.org/gmane.linux.kernel/2214250