Every CVE Search/ Get API key

CVE-2018-16880

A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A...

5.9 MediumFix available

A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

0.56%Down 0.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.9

A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.

Record
CVE-2018-16880
CVSS 3.0
5.9 MediumCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2018-8670 5.9

A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.

Record
EUVD-2018-8670
CVSS 3.0
5.9 MediumCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-x3fm-32v3-x7hm 7.0

A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A...

A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.

Record
GHSA-x3fm-32v3-x7hm
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
NVD 7.0

A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.

Record
CVE-2018-16880
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
5.9 MediumCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS 2.0
6.9 MediumAV:L/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-787
Updated
2026-11-02
OSVAZL-6518 7.0

CVE-2018-16880 affecting package kernel for versions less than 5.10.78.1-1

A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.

Record
AZL-6518
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.0

A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.

Record
CVE-2018-16880
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2018-16880 7.0

A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.

Record
DEBIAN-CVE-2018-16880
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-16880 7.0

A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. Versions from v4.16 and newer are vulnerable.

Record
UBUNTU-CVE-2018-16880
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
5.9 MediumCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS 3.0
7.0 HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2019:1404-1 No score

Security update for the Linux Kernel

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes.

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

  • CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)
  • CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)
  • CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)
  • CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

This kernel update contains software mitigations for these issues, which also utilize CPU microcode updates shipped in parallel.

For more information on this set of information leaks, check out https://www.suse.com/support/kb/doc/?id=7023736

The following security bugs were fixed:

  • CVE-2018-16880: A flaw was found in handle_rx() function in the vhost_net driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. (bnc#1122767).
  • CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c had multiple race conditions (bnc#1133188). It has been disabled.
  • CVE-2019-11815: An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c. There is a race condition leading to a use-after-free, related to net namespace cleanup (bnc#1134537).
  • CVE-2019-11884: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c allowed a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a '\0' character (bnc#1134848).
  • CVE-2019-3882: A flaw was found in vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). (bnc#1131416 bnc#1131427).
  • CVE-2019-9003: Attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a 'service ipmievd restart' loop (bnc#1126704).
  • CVE-2019-9500: A brcmfmac heap buffer overflow in brcmf_wowl_nd_results was fixed (bnc#1132681).
  • CVE-2019-9503: Multiple brcmfmac frame validation bypasses have been fixed (bnc#1132828).

The following non-security bugs were fixed:

  • 9p: do not trust pdu content for stat item size (bsc#1051510).
  • acpi, nfit: Prefer _DSM over _LSR for namespace label reads (bsc#1112128) (bsc#1132426).
  • ACPI / SBS: Fix GPE storm on recent MacBookPro's (bsc#1051510).
  • ALSA: core: Do not refer to snd_cards array directly (bsc#1051510).
  • ALSA: core: Fix card races between register and disconnect (bsc#1051510).
  • ALSA: emu10k1: Drop superfluous id-uniquification behavior (bsc#1051510).
  • ALSA: hda - Add two more machines to the power_save_blacklist (bsc#1051510).
  • ALSA: hda/hdmi - Consider eld_valid when reporting jack event (bsc#1051510).
  • ALSA: hda/hdmi - Read the pin sense from register when repolling (bsc#1051510).
  • ALSA: hda: Initialize power_state field properly (bsc#1051510).
  • ALSA: hda/realtek - Add new Dell platform for headset mode (bsc#1051510).
  • ALSA: hda/realtek - Add quirk for Tuxedo XC 1509 (bsc#1131442).
  • ALSA: hda/realtek - Add support headset mode for DELL WYSE AIO (bsc#1051510).
  • ALSA: hda/realtek - Add support headset mode for New DELL WYSE NB (bsc#1051510).
  • ALSA: hda/realtek - add two more pin configuration sets to quirk table (bsc#1051510).
  • ALSA: hda/realtek - Apply the fixup for ASUS Q325UAR (bsc#1051510).
  • ALSA: hda/realtek - EAPD turn on later (bsc#1051510).
  • ALSA: hda/realtek - Fixed Dell AIO speaker noise (bsc#1051510).
  • ALSA: hda - Register irq handler after the chip initialization (bsc#1051510).
  • ALSA:…
Record
openSUSE-SU-2019:1404-1
Updated
2026-11-02
OSVSUSE-SU-2019:1240-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 for Azure kernel was updated to receive various security and bugfixes.

Four new speculative execution issues have been identified in Intel CPUs. (bsc#1111331)

  • CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)
  • CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)
  • CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)
  • CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

This kernel update contains software mitigations, utilizing CPU microcode updates shipped in parallel.

For more information on this set of information leaks, check out https://www.suse.com/support/kb/doc/?id=7023736

The following security bugs were fixed:

  • CVE-2019-9003: Attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a 'service ipmievd restart' loop (bnc#1126704).
  • CVE-2018-16880: A flaw was found in the handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, can trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. (bnc#1122767).
  • CVE-2019-9500: A brcmfmac heap buffer overflow in brcmf_wowl_nd_results was fixed. (bnc#1132681).
  • CVE-2019-9503: A brcmfmac frame validation bypass was fixed. (bnc#1132828).
  • CVE-2019-3882: A flaw was found in the vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). (bnc#1131416 bnc#1131427).

The following non-security bugs were fixed:

  • 9p: do not trust pdu content for stat item size (bsc#1051510).
  • acpi: acpi_pad: Do not launch acpi_pad threads on idle cpus (bsc#1113399).
  • acpi, nfit: Prefer _DSM over _LSR for namespace label reads (bsc#1132426).
  • acpi / SBS: Fix GPE storm on recent MacBookPro's (bsc#1051510).
  • alsa: core: Fix card races between register and disconnect (bsc#1051510).
  • alsa: echoaudio: add a check for ioremap_nocache (bsc#1051510).
  • alsa: firewire: add const qualifier to identifiers for read-only symbols (bsc#1051510).
  • alsa: firewire-motu: add a flag for AES/EBU on XLR interface (bsc#1051510).
  • alsa: firewire-motu: add specification flag for position of flag for MIDI messages (bsc#1051510).
  • alsa: firewire-motu: add support for MOTU Audio Express (bsc#1051510).
  • alsa: firewire-motu: add support for Motu Traveler (bsc#1051510).
  • alsa: firewire-motu: use 'version' field of unit directory to identify model (bsc#1051510).
  • alsa: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist (bsc#1051510).
  • alsa: hda - Add two more machines to the power_save_blacklist (bsc#1051510).
  • alsa: hda - Enforces runtime_resume after S3 and S4 for each codec (bsc#1051510).
  • alsa: hda: Initialize power_state field properly (bsc#1051510).
  • alsa: hda/realtek - Add quirk for Tuxedo XC 1509 (bsc#1131442).
  • alsa: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 headset mic (bsc#1051510).
  • alsa: hda/realtek - Add support headset mode for DELL WYSE AIO (bsc#1051510).
  • alsa: hda/realtek - Add support headset mode for New DELL WYSE NB (bsc#1051510).
  • alsa: hda/realtek - add two more pin configuration sets to quirk table (bsc#1051510).
  • alsa: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with ALC256 (bsc#1051510).
  • alsa: hda/realtek: Enable headset MIC of Acer AIO with ALC286 (bsc#1051510).
  • alsa: hda/realtek: Enable headset MIC of Acer Aspire Z24-890 with ALC286 (bsc#1051510).
  • alsa: hda/realtek: Enable headset mic of ASUS P5440FF with ALC256 (bsc#1051510).
  • alsa: hda - Record the current power state before suspend/resume…
Record
SUSE-SU-2019:1240-1
Updated
2026-11-02
OSVSUSE-SU-2019:1241-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

  • CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)
  • CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)
  • CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)
  • CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

This kernel update contains software mitigations for these issues, which also utilize CPU microcode updates shipped in parallel.

For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736

The following security bugs were fixed:

  • CVE-2018-16880: A flaw was found in the handle_rx() function in the vhost_net driver. A malicious virtual guest, under specific conditions, could trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. (bnc#1122767).
  • CVE-2019-3882: A flaw was found in the vfio interface implementation that permitted violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). (bnc#1131416 bnc#1131427).
  • CVE-2019-9003: Attackers could trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a 'service ipmievd restart' loop (bnc#1126704).
  • CVE-2019-9500: A brcmfmac heap buffer overflow in brcmf_wowl_nd_results was fixed. (bnc#1132681).
  • CVE-2019-9503: A brcmfmac frame validation bypass was fixed. (bnc#1132828).

The following non-security bugs were fixed:

  • 9p: do not trust pdu content for stat item size (bsc#1051510).
  • ACPI: acpi_pad: Do not launch acpi_pad threads on idle cpus (bsc#1113399).
  • acpi, nfit: Prefer _DSM over _LSR for namespace label reads (bsc#1112128) (bsc#1132426).
  • ACPI / SBS: Fix GPE storm on recent MacBookPro's (bsc#1051510).
  • alsa: core: Fix card races between register and disconnect (bsc#1051510).
  • alsa: echoaudio: add a check for ioremap_nocache (bsc#1051510).
  • alsa: firewire: add const qualifier to identifiers for read-only symbols (bsc#1051510).
  • alsa: firewire-motu: add a flag for AES/EBU on XLR interface (bsc#1051510).
  • alsa: firewire-motu: add specification flag for position of flag for MIDI messages (bsc#1051510).
  • alsa: firewire-motu: add support for MOTU Audio Express (bsc#1051510).
  • alsa: firewire-motu: add support for Motu Traveler (bsc#1051510).
  • alsa: firewire-motu: use 'version' field of unit directory to identify model (bsc#1051510).
  • alsa: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist (bsc#1051510).
  • alsa: hda - Add two more machines to the power_save_blacklist (bsc#1051510).
  • alsa: hda - Enforces runtime_resume after S3 and S4 for each codec (bsc#1051510).
  • alsa: hda: Initialize power_state field properly (bsc#1051510).
  • alsa: hda/realtek - Add new Dell platform for headset mode (bsc#1051510).
  • alsa: hda/realtek - Add quirk for Tuxedo XC 1509 (bsc#1131442).
  • alsa: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 headset mic (bsc#1051510).
  • alsa: hda/realtek - Add support headset mode for DELL WYSE AIO (bsc#1051510).
  • alsa: hda/realtek - Add support headset mode for New DELL WYSE NB (bsc#1051510).
  • alsa: hda/realtek - add two more pin configuration sets to quirk table (bsc#1051510).
  • alsa: hda/realtek - Apply the fixup for ASUS Q325UAR (bsc#1051510).
  • alsa: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with ALC256 (bsc#1051510).
  • alsa: hda/realtek: Enable headset MIC of Acer AIO with ALC286 (bsc#1051510).
  • alsa: hda/realtek: Enable headset MIC of…
Record
SUSE-SU-2019:1241-1
Updated
2026-11-02
OSVSUSE-SU-2019:1242-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP4 Azure kernel was updated to receive various security and bugfixes.

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

  • CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)
  • CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)
  • CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)
  • CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

This kernel update contains software mitigations for these issues, which also utilize CPU microcode updates shipped in parallel.

For more information on this set of information leaks, check out https://www.suse.com/support/kb/doc/?id=7023736

The following security bugs were fixed:

  • CVE-2018-16880: A flaw was found in the handle_rx() function in the vhost_net driver. A malicious virtual guest, under specific conditions, could trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. (bnc#1122767).
  • CVE-2019-9003: Attackers could trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a 'service ipmievd restart' loop (bnc#1126704).
  • CVE-2019-9503: A brcmfmac frame validation bypass was fixed. (bnc#1132828).
  • CVE-2019-9500: A brcmfmac heap buffer overflow in brcmf_wowl_nd_results was fixed. (bnc#1132681).
  • CVE-2019-3882: A flaw was found in the vfio interface implementation that permitted violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). (bnc#1131416 bnc#1131427).

The following non-security bugs were fixed:

  • 9p: do not trust pdu content for stat item size (bsc#1051510).
  • acpi: acpi_pad: Do not launch acpi_pad threads on idle cpus (bsc#1113399).
  • acpi, nfit: Prefer _DSM over _LSR for namespace label reads (bsc#112128) (bsc#1132426).
  • acpi / sbs: Fix GPE storm on recent MacBookPro's (bsc#1051510).
  • alsa: core: Fix card races between register and disconnect (bsc#1051510).
  • alsa: echoaudio: add a check for ioremap_nocache (bsc#1051510).
  • alsa: firewire: add const qualifier to identifiers for read-only symbols (bsc#1051510).
  • alsa: firewire-motu: add a flag for AES/EBU on XLR interface (bsc#1051510).
  • alsa: firewire-motu: add specification flag for position of flag for MIDI messages (bsc#1051510).
  • alsa: firewire-motu: add support for MOTU Audio Express (bsc#1051510).
  • alsa: firewire-motu: add support for Motu Traveler (bsc#1051510).
  • alsa: firewire-motu: use 'version' field of unit directory to identify model (bsc#1051510).
  • alsa: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist (bsc#1051510).
  • alsa: hda - Add two more machines to the power_save_blacklist (bsc#1051510).
  • alsa: hda - Enforces runtime_resume after S3 and S4 for each codec (bsc#1051510).
  • alsa: hda: Initialize power_state field properly (bsc#1051510).
  • alsa: hda/realtek - Add new Dell platform for headset mode (bsc#1051510).
  • alsa: hda/realtek - Add quirk for Tuxedo XC 1509 (bsc#1131442).
  • alsa: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 headset mic (bsc#1051510).
  • alsa: hda/realtek - Add support headset mode for DELL WYSE AIO (bsc#1051510).
  • alsa: hda/realtek - Add support headset mode for New DELL WYSE NB (bsc#1051510).
  • alsa: hda/realtek - add two more pin configuration sets to quirk table (bsc#1051510).
  • alsa: hda/realtek - Apply the fixup for ASUS Q325UAR (bsc#1051510).
  • alsa: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with ALC256 (bsc#1051510).
  • alsa: hda/realtek: Enable headset MIC of Acer AIO with ALC286 (bsc#1051510).
  • alsa: hda/realtek: Enable headset…
Record
SUSE-SU-2019:1242-1
Updated
2026-11-02
OSVSUSE-SU-2019:1244-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

  • CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)
  • CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)
  • CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)
  • CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

This kernel update contains software mitigations for these issues, which also utilize CPU microcode updates shipped in parallel.

For more information on this set of vulnerabilities, check out https://www.suse.com/support/kb/doc/?id=7023736

The following security issues were fixed:

  • CVE-2018-16880: A flaw was found in the handle_rx() function in the vhost_net driver. A malicious virtual guest, under specific conditions, could trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. (bnc#1122767).
  • CVE-2019-3882: A flaw was found in the vfio interface implementation that permitted violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). (bnc#1131416 bnc#1131427).
  • CVE-2019-9003: Attackers could trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a 'service ipmievd restart' loop (bnc#1126704).
  • CVE-2019-9500: A brcmfmac heap buffer overflow in brcmf_wowl_nd_results was fixed. (bnc#1132681).
  • CVE-2019-9503: A brcmfmac frame validation bypass was fixed. (bnc#1132828).

The following non-security bugs were fixed:

  • 9p: do not trust pdu content for stat item size (bsc#1051510).
  • acpi: acpi_pad: Do not launch acpi_pad threads on idle cpus (bsc#1113399).
  • acpi, nfit: Prefer _DSM over _LSR for namespace label reads (bsc#1132426).
  • acpi / SBS: Fix GPE storm on recent MacBookPro's (bsc#1051510).
  • alsa: core: Fix card races between register and disconnect (bsc#1051510).
  • alsa: echoaudio: add a check for ioremap_nocache (bsc#1051510).
  • alsa: firewire: add const qualifier to identifiers for read-only symbols (bsc#1051510).
  • alsa: firewire-motu: add a flag for AES/EBU on XLR interface (bsc#1051510).
  • alsa: firewire-motu: add specification flag for position of flag for MIDI messages (bsc#1051510).
  • alsa: firewire-motu: add support for MOTU Audio Express (bsc#1051510).
  • alsa: firewire-motu: add support for Motu Traveler (bsc#1051510).
  • alsa: firewire-motu: use 'version' field of unit directory to identify model (bsc#1051510).
  • alsa: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist (bsc#1051510).
  • alsa: hda - Add two more machines to the power_save_blacklist (bsc#1051510).
  • alsa: hda - Enforces runtime_resume after S3 and S4 for each codec (bsc#1051510).
  • alsa: hda: Initialize power_state field properly (bsc#1051510).
  • alsa: hda/realtek - Add quirk for Tuxedo XC 1509 (bsc#1131442).
  • alsa: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 headset mic (bsc#1051510).
  • alsa: hda/realtek - Add support headset mode for DELL WYSE AIO (bsc#1051510).
  • alsa: hda/realtek - Add support headset mode for New DELL WYSE NB (bsc#1051510).
  • alsa: hda/realtek - add two more pin configuration sets to quirk table (bsc#1051510).
  • alsa: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with ALC256 (bsc#1051510).
  • alsa: hda/realtek: Enable headset MIC of Acer AIO with ALC286 (bsc#1051510).
  • alsa: hda/realtek: Enable headset MIC of Acer Aspire Z24-890 with ALC286 (bsc#1051510).
  • alsa: hda/realtek: Enable headset mic of ASUS P5440FF with ALC256 (bsc#1051510).
  • alsa: hda - Record the…
Record
SUSE-SU-2019:1244-1
Updated
2026-11-02
OSVSUSE-SU-2019:1550-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2019-12819: The function __mdiobus_register() called put_device(), which triggered a fixed_mdio_bus_init use-after-free. This would cause a denial of service. (bsc#1138291)

  • CVE-2019-12818: The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This used to affect nfc_llcp_build_gb in net/nfc/llcp_core.c. (bsc#1138293)

  • CVE-2019-11477: A sequence of SACKs may have been crafted such that one can trigger an integer overflow, leading to a kernel panic.

  • CVE-2019-11478: It was possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. An attacker may have been able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection.

  • CVE-2019-11479: An attacker could force the Linux kernel to segment its responses into multiple TCP segments. This would drastically increased the bandwidth required to deliver the same amount of data. Further, it would consume additional resources such as CPU and NIC processing power.

  • CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network. (bsc#1136424)

  • CVE-2019-10124: An issue was discovered in the hwpoison implementation in mm/memory-failure.c in the Linux kernel. When soft_offline_in_use_page() runs on a thp tail page after pmd is split, an attacker could cause a denial of service (bsc#1130699, CVE-2019-10124).

  • CVE-2019-12382: An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel There was an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). (bsc#1136586)

  • CVE-2019-11487: The Linux kernel allowed page reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It could occur with FUSE requests. (bbsc#1133190)

  • CVE-2019-5489: The mincore() implementation in mm/mincore.c in the Linux kernel allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server. (bsc#1120843)

  • CVE-2019-11833: fs/ext4/extents.c in the Linux kernel did not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem. (bsc#1135281)

  • CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019. (bsc##1111331)

  • CVE-2018-7191: In the tun subsystem in the Linux kernel, dev_get_valid_name was not called before register_netdevice. This allowed local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. (bsc#1135603)

  • CVE-2018-12126…

Record
SUSE-SU-2019:1550-1
Updated
2026-11-02
OSVSUSE-SU-2019:2430-1 No score

Security update for kernel-source-rt

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

  • CVE-2018-12126 CVE-2018-12127 CVE-2018-12130: Microarchitectural Store Buffer Data Sampling (MSBDS): Stored buffers on some microprocessors utilizing speculative execution which may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019. (bsc#1103186)
  • CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here: https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019. (bsc#1111331)
  • CVE-2019-12382: An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel There was an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). (bsc#1136586)
  • CVE-2019-10124: An issue was discovered in the hwpoison implementation in mm/memory-failure.c in the Linux kernel. When soft_offline_in_use_page() runs on a thp tail page after pmd is split, an attacker could cause a denial of service (bsc#1130699).
  • CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel has multiple race conditions. (bsc#1133188)
  • CVE-2019-11811: An issue was discovered in the Linux kernel There was a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module was removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c. (bsc#1134397)
  • CVE-2019-11487: The Linux kernel allowed page reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It could occur with FUSE requests. (bsc#1133190)
  • CVE-2019-12818: The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This used to affect nfc_llcp_build_gb in net/nfc/llcp_core.c. (bsc#1138293)
  • CVE-2019-11833: fs/ext4/extents.c in the Linux kernel did not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem. (bsc#1135281)
  • CVE-2019-5489: The mincore() implementation in mm/mincore.c in the Linux kernel allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server. (bsc#1120843)
  • CVE-2018-7191: In the tun subsystem in the Linux kernel, dev_get_valid_name was not called before register_netdevice. This allowed local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. (bsc#1135603)
  • CVE-2019-11884: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel allowed a local user to obtain potentially sensitive information from kernel stack memory via a hidPCONNADD command, because a name field may not end with a '\0' character. (bsc#1134848) -…
Record
SUSE-SU-2019:2430-1
Updated
2026-11-02
OSVUSN-3903-2 No score

linux-hwe, linux-azure vulnerabilities

USN-3903-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04 LTS.

Jason Wang discovered that the vhost net driver in the Linux kernel contained an out of bounds write vulnerability. An attacker in a guest virtual machine could use this to cause a denial of service (host system crash) or possibly execute arbitrary code in the host kernel. (CVE-2018-16880)

Jann Horn discovered that the userfaultd implementation in the Linux kernel did not properly restrict access to certain ioctls. A local attacker could use this possibly to modify files. (CVE-2018-18397)

Jann Horn discovered a race condition in the fork() system call in the Linux kernel. A local attacker could use this to gain access to services that cache authorizations. (CVE-2019-6133)

Record
USN-3903-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
kernel
Azure Linux:2
 before 5.10.78.1-1
5.10.78.1-1
linux
Debian:12
 before 4.19.20-1
4.19.20-1
linux
Debian:13
 before 4.19.20-1
4.19.20-1
linux
Debian:14
 before 4.19.20-1
4.19.20-1
kernel-azure
SUSE:Linux Enterprise Module for Public Cloud 15
 before 4.12.14-5.27.1
4.12.14-5.27.1
kernel-source-azure
SUSE:Linux Enterprise Module for Public Cloud 15
 before 4.12.14-5.27.1
4.12.14-5.27.1
kernel-syms-azure
SUSE:Linux Enterprise Module for Public Cloud 15
 before 4.12.14-5.27.1
4.12.14-5.27.1
kernel-default
SUSE:Linux Enterprise Desktop 12 SP4
 before 4.12.14-95.16.1
4.12.14-95.16.1
kernel-source
SUSE:Linux Enterprise Desktop 12 SP4
 before 4.12.14-95.16.1
4.12.14-95.16.1
kernel-syms
SUSE:Linux Enterprise Desktop 12 SP4
 before 4.12.14-95.16.1
4.12.14-95.16.1
Show 58 moreShow less
Affected packages
PackageAffectedFixed
kernel-default
SUSE:Linux Enterprise High Availability Extension 12 SP4
 before 4.12.14-95.16.1
4.12.14-95.16.1
kgraft-patch-SLE12-SP4_Update_4
SUSE:Linux Enterprise Live Patching 12 SP4
 before 1-6.3.1
1-6.3.1
kernel-docs
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 4.12.14-95.16.1
4.12.14-95.16.1
kernel-obs-build
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 4.12.14-95.16.1
4.12.14-95.16.1
kernel-default
SUSE:Linux Enterprise Server 12 SP4
 before 4.12.14-95.16.1
4.12.14-95.16.1
kernel-source
SUSE:Linux Enterprise Server 12 SP4
 before 4.12.14-95.16.1
4.12.14-95.16.1
kernel-syms
SUSE:Linux Enterprise Server 12 SP4
 before 4.12.14-95.16.1
4.12.14-95.16.1
kernel-default
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 4.12.14-95.16.1
4.12.14-95.16.1
kernel-source
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 4.12.14-95.16.1
4.12.14-95.16.1
kernel-syms
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 4.12.14-95.16.1
4.12.14-95.16.1
kernel-default
SUSE:Linux Enterprise Workstation Extension 12 SP4
 before 4.12.14-95.16.1
4.12.14-95.16.1
kernel-azure
SUSE:Linux Enterprise Server 12 SP4
 before 4.12.14-6.12.1
4.12.14-6.12.1
kernel-source-azure
SUSE:Linux Enterprise Server 12 SP4
 before 4.12.14-6.12.1
4.12.14-6.12.1
kernel-syms-azure
SUSE:Linux Enterprise Server 12 SP4
 before 4.12.14-6.12.1
4.12.14-6.12.1
kernel-azure
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 4.12.14-6.12.1
4.12.14-6.12.1
kernel-source-azure
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 4.12.14-6.12.1
4.12.14-6.12.1
kernel-syms-azure
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 4.12.14-6.12.1
4.12.14-6.12.1
kernel-default
SUSE:Linux Enterprise Module for Basesystem 15
 before 4.12.14-150.17.1
4.12.14-150.17.1
kernel-source
SUSE:Linux Enterprise Module for Basesystem 15
 before 4.12.14-150.17.1
4.12.14-150.17.1
kernel-zfcpdump
SUSE:Linux Enterprise Module for Basesystem 15
 before 4.12.14-150.17.1
4.12.14-150.17.1
kernel-docs
SUSE:Linux Enterprise Module for Development Tools 15
 before 4.12.14-150.17.1
4.12.14-150.17.1
kernel-obs-build
SUSE:Linux Enterprise Module for Development Tools 15
 before 4.12.14-150.17.1
4.12.14-150.17.1
kernel-source
SUSE:Linux Enterprise Module for Development Tools 15
 before 4.12.14-150.17.1
4.12.14-150.17.1
kernel-syms
SUSE:Linux Enterprise Module for Development Tools 15
 before 4.12.14-150.17.1
4.12.14-150.17.1
kernel-vanilla
SUSE:Linux Enterprise Module for Development Tools 15
 before 4.12.14-150.17.1
4.12.14-150.17.1
kernel-default
SUSE:Linux Enterprise Module for Legacy 15
 before 4.12.14-150.17.1
4.12.14-150.17.1
kernel-default
SUSE:Linux Enterprise Live Patching 15
 before 4.12.14-150.17.1
4.12.14-150.17.1
kernel-livepatch-SLE15_Update_10
SUSE:Linux Enterprise Live Patching 15
 before 1-1.3.1
1-1.3.1
kernel-default
SUSE:Linux Enterprise High Availability Extension 15
 before 4.12.14-150.17.1
4.12.14-150.17.1
kernel-default
SUSE:Linux Enterprise Workstation Extension 15
 before 4.12.14-150.17.1
4.12.14-150.17.1
kernel-default
SUSE:Linux Enterprise Module for Basesystem 15 SP1
 before 4.12.14-197.4.1
4.12.14-197.4.1
kernel-source
SUSE:Linux Enterprise Module for Basesystem 15 SP1
 before 4.12.14-197.4.1
4.12.14-197.4.1
kernel-zfcpdump
SUSE:Linux Enterprise Module for Basesystem 15 SP1
 before 4.12.14-197.4.1
4.12.14-197.4.1
kernel-docs
SUSE:Linux Enterprise Module for Development Tools 15 SP1
 before 4.12.14-197.4.1
4.12.14-197.4.1
kernel-obs-build
SUSE:Linux Enterprise Module for Development Tools 15 SP1
 before 4.12.14-197.4.1
4.12.14-197.4.1
kernel-source
SUSE:Linux Enterprise Module for Development Tools 15 SP1
 before 4.12.14-197.4.1
4.12.14-197.4.1
kernel-syms
SUSE:Linux Enterprise Module for Development Tools 15 SP1
 before 4.12.14-197.4.1
4.12.14-197.4.1
kernel-default
SUSE:Linux Enterprise Module for Legacy 15 SP1
 before 4.12.14-197.4.1
4.12.14-197.4.1
kernel-default
SUSE:Linux Enterprise Live Patching 15 SP1
 before 4.12.14-197.4.1
4.12.14-197.4.1
kernel-livepatch-SLE15-SP1_Update_1
SUSE:Linux Enterprise Live Patching 15 SP1
 before 1-3.3.1
1-3.3.1
kernel-default
SUSE:Linux Enterprise High Availability Extension 15 SP1
 before 4.12.14-197.4.1
4.12.14-197.4.1
kernel-default
SUSE:Linux Enterprise Workstation Extension 15 SP1
 before 4.12.14-197.4.1
4.12.14-197.4.1
kernel-rt
SUSE:Real Time Module 15 SP1
 before 4.12.14-14.8.1
4.12.14-14.8.1
kernel-rt_debug
SUSE:Real Time Module 15 SP1
 before 4.12.14-14.8.1
4.12.14-14.8.1
kernel-source-rt
SUSE:Real Time Module 15 SP1
 before 4.12.14-14.8.1
4.12.14-14.8.1
kernel-syms-rt
SUSE:Real Time Module 15 SP1
 before 4.12.14-14.8.1
4.12.14-14.8.1
linux-azure
Ubuntu:18.04:LTS
 before 4.18.0-1013.13~18.04.1, plus listed versions
4.15.0-1002.24.15.0-1003.34.15.0-1004.44.15.0-1008.84.15.0-1009.9
Show 17 moreShow less
4.15.0-1012.124.15.0-1013.134.15.0-1014.144.15.0-1018.184.15.0-1019.194.15.0-1021.214.15.0-1022.234.15.0-1023.244.15.0-1025.264.15.0-1028.294.15.0-1030.314.15.0-1031.324.15.0-1032.334.15.0-1035.364.15.0-1036.384.15.0-1037.394.18.0-1011.11~18.04.1
4.18.0-1013.13~18.04.1
linux-gcp-edge
Ubuntu:18.04:LTS
 before 4.18.0-1007.8~18.04.1, plus listed versions
4.18.0-1004.5~18.04.14.18.0-1005.6~18.04.14.18.0-1006.7~18.04.1
4.18.0-1007.8~18.04.1
linux-hwe
Ubuntu:18.04:LTS
 before 4.18.0-16.17~18.04.1, plus listed versions
4.18.0-13.14~18.04.14.18.0-14.15~18.04.14.18.0-15.16~18.04.1
4.18.0-16.17~18.04.1
kernel-debug
openSUSE:Leap 15.0
 before 4.12.14-lp150.12.61.1
4.12.14-lp150.12.61.1
kernel-default
openSUSE:Leap 15.0
 before 4.12.14-lp150.12.61.1
4.12.14-lp150.12.61.1
kernel-docs
openSUSE:Leap 15.0
 before 4.12.14-lp150.12.61.1
4.12.14-lp150.12.61.1
kernel-kvmsmall
openSUSE:Leap 15.0
 before 4.12.14-lp150.12.61.1
4.12.14-lp150.12.61.1
kernel-obs-build
openSUSE:Leap 15.0
 before 4.12.14-lp150.12.61.1
4.12.14-lp150.12.61.1
kernel-obs-qa
openSUSE:Leap 15.0
 before 4.12.14-lp150.12.61.1
4.12.14-lp150.12.61.1
kernel-source
openSUSE:Leap 15.0
 before 4.12.14-lp150.12.61.1
4.12.14-lp150.12.61.1
kernel-syms
openSUSE:Leap 15.0
 before 4.12.14-lp150.12.61.1
4.12.14-lp150.12.61.1
kernel-vanilla
openSUSE:Leap 15.0
 before 4.12.14-lp150.12.61.1
4.12.14-lp150.12.61.1

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-16880 is a medium vulnerability (CVSS 5.9) in Linux Kernel, published January 29, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in kernel 5.10.78.1-1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 472 references and the rest of 7 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open