{"id":"CVE-2015-4692","aliases":["DEBIAN-CVE-2015-4692","EUVD-2015-4711","GHSA-wqc9-vcg5-v949","MGASA-2015-0386","MGASA-2015-0390","MGASA-2016-0015","SUSE-SU-2015:1324-1","UBUNTU-CVE-2015-4692","USN-2681-1","USN-2682-1","USN-2683-1"],"status":"published","title":"The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows...","description":"The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.","severity":{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:C","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00451,"percentile":0.39428,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2015-06-22T00:00:00Z","modified":"2026-09-09T06:47:18Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.0.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.0.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.0.8-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-58.97"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","fixed_in":["3.16.0-44.59~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","fixed_in":["3.19.0-23.24~14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20150722-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"btrfs-progs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"iproute2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-4.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-firmware-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20150824-1.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"radeon-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20150824-1.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-broadcom-wl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.30.223.248-36.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-fglrx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.200.1046-5.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"nvidia304","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"304.125-5.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-nvidia304","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"304.125-41.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"nvidia340","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"340.76-2.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-nvidia340","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"340.76-31.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-nvidia-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"346.82-3.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-1.mga5"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.15-1.mga5"}]}],"bundled":22},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12","package":"kgraft-patch-SLE12_Update_6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.3"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.44-52.10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-58.97"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-44.59~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1","3.16.0-33.44~14.04.1","3.16.0-34.45~14.04.1","3.16.0-34.47~14.04.1","3.16.0-36.48~14.04.1","3.16.0-37.49~14.04.1","3.16.0-37.51~14.04.1","3.16.0-38.52~14.04.1","3.16.0-39.53~14.04.1","3.16.0-40.54~14.04.1","3.16.0-41.55~14.04.1","3.16.0-41.57~14.04.1","3.16.0-43.58~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-23.24~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1","3.19.0-20.20~14.04.1","3.19.0-21.21~14.04.1","3.19.0-22.22~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-58.97"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-44.59~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1","3.16.0-33.44~14.04.1","3.16.0-34.45~14.04.1","3.16.0-34.47~14.04.1","3.16.0-36.48~14.04.1","3.16.0-37.49~14.04.1","3.16.0-37.51~14.04.1","3.16.0-38.52~14.04.1","3.16.0-39.53~14.04.1","3.16.0-40.54~14.04.1","3.16.0-41.55~14.04.1","3.16.0-41.57~14.04.1","3.16.0-43.58~14.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-23.24~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1","3.19.0-20.20~14.04.1","3.19.0-21.21~14.04.1","3.19.0-22.22~14.04.1"],"bundled":4}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2015/06/21/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2680-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2682-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1230770","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/torvalds/linux/commit/ce40cd3fc7fa40a6119e5fe6c0f2bc0eb4541009","tags":["x_refsource_CONFIRM","x_transferred","fix"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3329","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/161144.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2684-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2681-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2683-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/75142","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce40cd3fc7fa40a6119e5fe6c0f2bc0eb4541009","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1032798","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160829.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-4692"},{"url":"https://github.com/advisories/GHSA-wqc9-vcg5-v949"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-4692","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0386.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16655","tags":["report"]},{"url":"http://kernelnewbies.org/Linux_4.0","tags":["web"]},{"url":"http://kernelnewbies.org/Linux_4.1","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.1","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.2","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.3","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.5","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.6","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.7","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.8","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0390.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16654","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2016-0015.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17401","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16915","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17010","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17034","tags":["report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.9","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.10","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.11","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.12","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.13","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.14","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.15","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151324-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/854817","tags":["report"]},{"url":"https://bugzilla.suse.com/854824","tags":["report"]},{"url":"https://bugzilla.suse.com/858727","tags":["report"]},{"url":"https://bugzilla.suse.com/866911","tags":["report"]},{"url":"https://bugzilla.suse.com/867362","tags":["report"]},{"url":"https://bugzilla.suse.com/895814","tags":["report"]},{"url":"https://bugzilla.suse.com/903279","tags":["report"]},{"url":"https://bugzilla.suse.com/907092","tags":["report"]},{"url":"https://bugzilla.suse.com/908491","tags":["report"]},{"url":"https://bugzilla.suse.com/915183","tags":["report"]},{"url":"https://bugzilla.suse.com/917630","tags":["report"]},{"url":"https://bugzilla.suse.com/918618","tags":["report"]},{"url":"https://bugzilla.suse.com/921430","tags":["report"]},{"url":"https://bugzilla.suse.com/924071","tags":["report"]},{"url":"https://bugzilla.suse.com/924526","tags":["report"]},{"url":"https://bugzilla.suse.com/926369","tags":["report"]},{"url":"https://bugzilla.suse.com/926953","tags":["report"]},{"url":"https://bugzilla.suse.com/927455","tags":["report"]},{"url":"https://bugzilla.suse.com/927697","tags":["report"]},{"url":"https://bugzilla.suse.com/927786","tags":["report"]},{"url":"https://bugzilla.suse.com/928131","tags":["report"]},{"url":"https://bugzilla.suse.com/929475","tags":["report"]},{"url":"https://bugzilla.suse.com/929696","tags":["report"]},{"url":"https://bugzilla.suse.com/929879","tags":["report"]},{"url":"https://bugzilla.suse.com/929974","tags":["report"]},{"url":"https://bugzilla.suse.com/930092","tags":["report"]},{"url":"https://bugzilla.suse.com/930399","tags":["report"]},{"url":"https://bugzilla.suse.com/930579","tags":["report"]},{"url":"https://bugzilla.suse.com/930599","tags":["report"]},{"url":"https://bugzilla.suse.com/930972","tags":["report"]},{"url":"https://bugzilla.suse.com/931124","tags":["report"]},{"url":"https://bugzilla.suse.com/931403","tags":["report"]},{"url":"https://bugzilla.suse.com/931538","tags":["report"]},{"url":"https://bugzilla.suse.com/931620","tags":["report"]},{"url":"https://bugzilla.suse.com/931860","tags":["report"]},{"url":"https://bugzilla.suse.com/931988","tags":["report"]},{"url":"https://bugzilla.suse.com/932348","tags":["report"]},{"url":"https://bugzilla.suse.com/932793","tags":["report"]},{"url":"https://bugzilla.suse.com/932897","tags":["report"]},{"url":"https://bugzilla.suse.com/932898","tags":["report"]},{"url":"https://bugzilla.suse.com/932899","tags":["report"]},{"url":"https://bugzilla.suse.com/932900","tags":["report"]},{"url":"https://bugzilla.suse.com/932967","tags":["report"]},{"url":"https://bugzilla.suse.com/933117","tags":["report"]},{"url":"https://bugzilla.suse.com/933429","tags":["report"]},{"url":"https://bugzilla.suse.com/933637","tags":["report"]},{"url":"https://bugzilla.suse.com/933896","tags":["report"]},{"url":"https://bugzilla.suse.com/933904","tags":["report"]},{"url":"https://bugzilla.suse.com/933907","tags":["report"]},{"url":"https://bugzilla.suse.com/934160","tags":["report"]},{"url":"https://bugzilla.suse.com/935083","tags":["report"]},{"url":"https://bugzilla.suse.com/935085","tags":["report"]},{"url":"https://bugzilla.suse.com/935088","tags":["report"]},{"url":"https://bugzilla.suse.com/935174","tags":["report"]},{"url":"https://bugzilla.suse.com/935542","tags":["report"]},{"url":"https://bugzilla.suse.com/935881","tags":["report"]},{"url":"https://bugzilla.suse.com/935918","tags":["report"]},{"url":"https://bugzilla.suse.com/936012","tags":["report"]},{"url":"https://bugzilla.suse.com/936423","tags":["report"]},{"url":"https://bugzilla.suse.com/936445","tags":["report"]},{"url":"https://bugzilla.suse.com/936446","tags":["report"]},{"url":"https://bugzilla.suse.com/936502","tags":["report"]},{"url":"https://bugzilla.suse.com/936556","tags":["report"]},{"url":"https://bugzilla.suse.com/936831","tags":["report"]},{"url":"https://bugzilla.suse.com/936875","tags":["report"]},{"url":"https://bugzilla.suse.com/937032","tags":["report"]},{"url":"https://bugzilla.suse.com/937087","tags":["report"]},{"url":"https://bugzilla.suse.com/937609","tags":["report"]},{"url":"https://bugzilla.suse.com/937612","tags":["report"]},{"url":"https://bugzilla.suse.com/937613","tags":["report"]},{"url":"https://bugzilla.suse.com/937616","tags":["report"]},{"url":"https://bugzilla.suse.com/938022","tags":["report"]},{"url":"https://bugzilla.suse.com/938023","tags":["report"]},{"url":"https://bugzilla.suse.com/938024","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5366","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-4692","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/06/10/6","tags":["report"]},{"url":"https://lkml.org/lkml/2015/6/4/163","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2680-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2681-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2682-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2683-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2684-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-4692","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2685-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-1805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-4700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5366","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5706","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-4692","description":"The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.","status":"published","published":"2015-07-27T10:00:00Z","modified":"2024-08-06T06:18:12.182Z","updated_at":"2026-11-02T14:35:43.322279Z"}],"euvd":[{"id":"EUVD-2015-4711","description":"The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.","status":"published","published":"2015-07-27T10:00:00Z","modified":"2024-08-06T06:18:12Z","updated_at":"2026-11-03T02:22:03.142599Z"}],"ghsa":[{"id":"GHSA-wqc9-vcg5-v949","title":"The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows...","description":"The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.","status":"published","published":"2022-05-17T00:48:49Z","modified":"2023-02-03T05:02:25Z","updated_at":"2026-11-02T14:53:10.235484Z"}],"nvd":[{"id":"CVE-2015-4692","description":"The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.","status":"published","published":"2015-07-27T10:59:00.063Z","modified":"2026-06-17T00:27:44.273Z","cvss":[{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:03:07.96297Z"}],"osv":[{"id":"CVE-2015-4692","description":"The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.","status":"published","published":"2015-07-27T10:59:00Z","modified":"2026-04-16T06:20:19.291157643Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-4692","description":"The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.","status":"published","published":"2015-07-27T10:59:00.063Z","modified":"2026-09-09T06:47:18.662079201Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"MGASA-2015-0386","title":"Updated kernel packages provides 4.1 longterm and fixes security issues","description":"This kernel update provides an upgrade to the upstream 4.1 longterm kernel\nseries, currently based on 4.1.8 and resolves at least the following\nsecurity issues:\n\nIt was found that the Linux kernel's keyring implementation would leak\nmemory when adding a key to a keyring via the add_key() function. A\nlocal attacker could use this flaw to exhaust all available memory on\nthe system. (CVE-2015-1333)\n\nA flaw was found in the Linux kernel where the deletion of a file or\ndirectory could trigger an unmount and reveal data under a mount point.\nThis flaw was inadvertently introduced with the new feature of being able\nto lazily unmount a mount tree when using file system user namespaces.\n(CVE-2015-4176)\n\nA flaw was discovered in the kernel's collect_mounts function. If the kernel\naudit subsystem called collect_mounts to audit an unmounted path, it could\npanic the system. With this flaw, an unprivileged user could call umount\n(MNT_DETACH) to launch a denial-of-service attack. (CVE-2015-4177)\n\nA flaw was found in the Linux kernel which is related to the user namespace\nlazily unmounting file systems. The fs_pin struct has two members (m_list\nand s_list) which are usually initialized on use in the pin_insert_group\nfunction. However, these members might go unmodified; in this case, the\nsystem panics when it attempts to destroy or free them. This flaw could be\nused to launch a denial-of-service attack. (CVE-2015-4178)\n\nA DoS flaw was found for a Linux kernel built for the x86 architecture which\nhad the KVM virtualization support(CONFIG_KVM) enabled. The kernel would be\nvulnerable to a NULL pointer dereference flaw in Linux kernel's\nkvm_apic_has_events() function while doing an ioctl. An unprivileged user\nable to access the \"/dev/kvm\" device could use this flaw to crash the system\nkernel. (CVE-2015-4692)\n\nA flaw was found in the kernel's implementation of the Berkeley Packet\nFilter (BPF). A local attacker could craft BPF code to crash the system\nby creating a situation in which the JIT compiler would fail to correctly\noptimize the JIT image on the last pass. This would lead to the CPU\nexecuting instructions that were not part of the JIT code. (CVE-2015-4700)\n\nThe get_bitmap_file function in drivers/md/md.c in the Linux kernel before\n4.1.6 does not initialize a certain bitmap data structure, which allows\nlocal users to obtain sensitive information from kernel memory via a\nGET_BITMAP_FILE ioctl call. (CVE-2015-5697)\n\nUse-after-free vulnerability in the path_openat function in fs/namei.c in\nthe Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a\ndenial of service or possibly have unspecified other impact via O_TMPFILE\nfilesystem operations that leverage a duplicate cleanup operation.\n(CVE-2015-5706)\n\nIt was discovered that an integer overflow error existed in the SCSIgeneric\n(sg) driver in the Linux kernel. A local attacker with writepermission to a\nSCSI generic device could use this to cause a denial of service (system\ncrash) or potentially escalate their privileges. (CVE-2015-5707)\n\nAdditionally the following packages have been updated to add or improve \nsupport for the 4.1 series kernels: btrfs-progs, iproute2, xtables-addons,\nnvidia304, nvidia340, kernel-firmware-nonfree, radeon-firmware.\n\nFor other changes, see the referenced changelogs:\n","status":"published","published":"2015-09-30T21:35:18Z","modified":"2026-04-16T06:23:54.800942025Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"MGASA-2015-0390","title":"Updated kernel-linus package provides 4.1 longterm and fixes security issues","description":"This kernel-linus update provides an upgrade to the upstream 4.1 longterm\nkernel series, currently based on 4.1.8 and resolves at least the following\nsecurity issues:\n\nIt was found that the Linux kernel's keyring implementation would leak\nmemory when adding a key to a keyring via the add_key() function. A\nlocal attacker could use this flaw to exhaust all available memory on\nthe system. (CVE-2015-1333)\n\nA flaw was found in the Linux kernel where the deletion of a file or\ndirectory could trigger an unmount and reveal data under a mount point.\nThis flaw was inadvertently introduced with the new feature of being able\nto lazily unmount a mount tree when using file system user namespaces.\n(CVE-2015-4176)\n\nA flaw was discovered in the kernel's collect_mounts function. If the kernel\naudit subsystem called collect_mounts to audit an unmounted path, it could\npanic the system. With this flaw, an unprivileged user could call umount\n(MNT_DETACH) to launch a denial-of-service attack. (CVE-2015-4177)\n\nA flaw was found in the Linux kernel which is related to the user namespace\nlazily unmounting file systems. The fs_pin struct has two members (m_list\nand s_list) which are usually initialized on use in the pin_insert_group\nfunction. However, these members might go unmodified; in this case, the\nsystem panics when it attempts to destroy or free them. This flaw could be\nused to launch a denial-of-service attack. (CVE-2015-4178)\n\nA DoS flaw was found for a Linux kernel built for the x86 architecture which\nhad the KVM virtualization support(CONFIG_KVM) enabled. The kernel would be\nvulnerable to a NULL pointer dereference flaw in Linux kernel's\nkvm_apic_has_events() function while doing an ioctl. An unprivileged user\nable to access the \"/dev/kvm\" device could use this flaw to crash the system\nkernel. (CVE-2015-4692)\n\nA flaw was found in the kernel's implementation of the Berkeley Packet\nFilter (BPF). A local attacker could craft BPF code to crash the system\nby creating a situation in which the JIT compiler would fail to correctly\noptimize the JIT image on the last pass. This would lead to the CPU\nexecuting instructions that were not part of the JIT code. (CVE-2015-4700)\n\nThe get_bitmap_file function in drivers/md/md.c in the Linux kernel before\n4.1.6 does not initialize a certain bitmap data structure, which allows\nlocal users to obtain sensitive information from kernel memory via a\nGET_BITMAP_FILE ioctl call. (CVE-2015-5697)\n\nUse-after-free vulnerability in the path_openat function in fs/namei.c in\nthe Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a\ndenial of service or possibly have unspecified other impact via O_TMPFILE\nfilesystem operations that leverage a duplicate cleanup operation.\n(CVE-2015-5706)\n\nIt was discovered that an integer overflow error existed in the SCSIgeneric\n(sg) driver in the Linux kernel. A local attacker with writepermission to a\nSCSI generic device could use this to cause a denial of service (system\ncrash) or potentially escalate their privileges. (CVE-2015-5707)\n\nFor other changes, see the referenced changelogs:\n","status":"published","published":"2015-10-09T18:47:39Z","modified":"2026-04-16T06:22:39.105102835Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"MGASA-2016-0015","title":"Updated kernel-tmb packages provides 4.1 longterm kernel and fixes security issues","description":"This kernel-tmb update provides an upgrade to the upstream 4.1 longterm\nkernel series, currently based on 4.1.15 and resolves at least the\nfollowing security issues:\n\nIt was found that the Linux kernel's keyring implementation would leak\nmemory when adding a key to a keyring via the add_key() function. A\nlocal attacker could use this flaw to exhaust all available memory on\nthe system. (CVE-2015-1333)\n\nA flaw was found in the Linux kernel where the deletion of a file or\ndirectory could trigger an unmount and reveal data under a mount point.\nThis flaw was inadvertently introduced with the new feature of being able\nto lazily unmount a mount tree when using file system user namespaces.\n(CVE-2015-4176)\n\nA flaw was discovered in the kernel's collect_mounts function. If the kernel\naudit subsystem called collect_mounts to audit an unmounted path, it could\npanic the system. With this flaw, an unprivileged user could call umount\n(MNT_DETACH) to launch a denial-of-service attack. (CVE-2015-4177)\n\nA flaw was found in the Linux kernel which is related to the user namespace\nlazily unmounting file systems. The fs_pin struct has two members (m_list\nand s_list) which are usually initialized on use in the pin_insert_group\nfunction. However, these members might go unmodified; in this case, the\nsystem panics when it attempts to destroy or free them. This flaw could be\nused to launch a denial-of-service attack. (CVE-2015-4178)\n\nA DoS flaw was found for a Linux kernel built for the x86 architecture which\nhad the KVM virtualization support(CONFIG_KVM) enabled. The kernel would be\nvulnerable to a NULL pointer dereference flaw in Linux kernel's\nkvm_apic_has_events() function while doing an ioctl. An unprivileged user\nable to access the \"/dev/kvm\" device could use this flaw to crash the system\nkernel. (CVE-2015-4692)\n\nA flaw was found in the kernel's implementation of the Berkeley Packet\nFilter (BPF). A local attacker could craft BPF code to crash the system\nby creating a situation in which the JIT compiler would fail to correctly\noptimize the JIT image on the last pass. This would lead to the CPU\nexecuting instructions that were not part of the JIT code. (CVE-2015-4700)\n\nThe virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel\nbefore 4.2 attempts to support a FRAGLIST feature without proper memory\nallocation, which allows guest OS users to cause a denial of service (buffer\noverflow and memory corruption) via a crafted sequence of fragmented packets.\n(CVE-2015-5156)\n\nMoein Ghasemzadeh discovered that the USB WhiteHEAT serial driver contained\nhardcoded attributes about the USB devices. An attacker could construct a\nfake WhiteHEAT USB device that, when inserted, causes a denial of service\n(system crash) (CVE-2015-5257).\n\nA guest to host DoS issue was found affecting various hypervisors. In that,\na guest can DoS the host by triggering an infinite stream of \"alignment\ncheck\" (#AC) exceptions. This causes the microcode to enter an infinite loop\nwhere the core never receives another interrupt. The host kernel panics due\nto this effect (CVE-2015-5307).\n\nThe get_bitmap_file function in drivers/md/md.c in the Linux kernel before\n4.1.6 does not initialize a certain bitmap data structure, which allows\nlocal users to obtain sensitive information from kernel memory via a\nGET_BITMAP_FILE ioctl call. (CVE-2015-5697)\n\nUse-after-free vulnerability in the path_openat function in fs/namei.c in\nthe Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a\ndenial of service or possibly have unspecified other impact via O_TMPFILE\nfilesystem operations that leverage a duplicate cleanup operation.\n(CVE-2015-5706)\n\nIt was discovered that an integer overflow error existed in the SCSIgeneric\n(sg) driver in the Linux kernel. A local attacker with writepermission to a\nSCSI generic device could use this to cause a denial of service (system\ncrash) or potentially escalate their privileges. (CVE-2015-5707)\n\nThe __rds_conn_create function in net/rds/connection.c in the Linux kernel\nthrough 4.2.3 allows local users to cause a denial of service (NULL pointer\ndereference and system crash) or possibly have unspecified other impact by\nusing a socket that was not properly bound (CVE-2015-6937).\n\nThe key_gc_unused_keys function in security/keys/gc.c in the Linux kernel\nthrough 4.2.6 allows local users to cause a denial of service (OOPS) via\ncrafted keyctl commands (CVE-2015-7872).\n\nThe vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in\nthe Linux kernel through 4.3.3 does not initialize a certain structure\nmember, which allows local users to obtain sensitive information from\nkernel memory via a crafted application (CVE-2015-7884).\n\nThe dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the\nLinux kernel through 4.3.3 does not initialize a certain structure member,\nwhich allows local users to obtain sensitive information from kernel memory\nvia a crafted application (CVE-2015-7885).\n\nA guest to host DoS issue was found affecting various hypervisors. In that,\na guest can DoS the host by triggering an infinite stream of \"debug check\"\n(#DB) exceptions. This causes the microcode to enter an infinite loop where\nthe core never receives another interrupt. The host kernel panics due to\nthis effect (CVE-2015-8104).\n\nFelix Wilhelm discovered a race condition in the Xen paravirtualized\ndrivers which can cause double fetch vulnerabilities. An attacker in the\nparavirtualized guest could exploit this flaw to cause a denial of service\n(crash the host) or potentially execute arbitrary code on the host\n(CVE-2015-8550 / XSA-155).\n\nKonrad Rzeszutek Wilk discovered the Xen PCI backend driver does not\nperform sanity checks on the device's state. An attacker could exploit\nthis flaw to cause a denial of service (NULL dereference) on the host\n(CVE-2015-8551 / XSA-157).\n\nKonrad Rzeszutek Wilk discovered the Xen PCI backend driver does not\nperform sanity checks on the device's state. An attacker could exploit\nthis flaw to cause a denial of service by flooding the logging system\nwith WARN() messages causing the initial domain to exhaust disk space\n(CVE-2015-8552 / XSA-157).\n\nThe ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel\nthrough 4.3.3 attempts to merge distinct setattr operations, which allows\nlocal users to bypass intended access restrictions and modify the\nattributes of arbitrary overlay files via a crafted application\n(CVE-2015-8660).\n\nFor other upstream fixes, see the referenced changelogs.\n\nOther fixes in this update:\n* improve ath10k (QCA99X0, QCA988X, QCA6174) support (mga#16915)\n* silence a harmless warning on 32bit non-dt hardware (mga#17010)\n* fix regression with AlpsPS/2 ALPS DualPoint TouchPad of a Dell\n  Latitude D600 (mga#17034)\n","status":"published","published":"2016-01-14T01:44:39Z","modified":"2026-04-16T06:23:47.399673436Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"SUSE-SU-2015:1324-1","title":"Security update for the SUSE Linux Enterprise 12 kernel","description":"The SUSE Linux Enterprise 12 kernel was updated to 3.12.44 to receive various security and bugfixes.\n\nThese features were added:\n- mpt2sas: Added Reply Descriptor Post Queue (RDPQ) Array support (bsc#854824).\n- mpt3sas: Bump mpt3sas driver version to 04.100.00.00 (bsc#854817).\n\nFollowing security bugs were fixed:\n- CVE-2015-1805: iov overrun for failed atomic copy could have lead to\n  DoS or privilege escalation (bsc#933429).\n- CVE-2015-3212: A race condition in the way the Linux kernel handled\n  lists of associations in SCTP sockets could have lead to list\n  corruption and kernel panics (bsc#936502).\n- CVE-2015-4036: DoS via memory corruption in vhost/scsi driver\n  (bsc#931988).\n- CVE-2015-4167: Linux kernel built with the UDF file\n  system(CONFIG_UDF_FS) support was vulnerable to a crash. It occurred\n  while fetching inode information from a corrupted/malicious udf file\n  system image (bsc#933907).\n- CVE-2015-4692: DoS via NULL pointer dereference in kvm_apic_has_events\n  function (bsc#935542).\n- CVE-2015-5364: Remote DoS via flood of UDP packets with invalid\n  checksums (bsc#936831).\n- CVE-2015-5366: Remote DoS of EPOLLET epoll applications via flood of\n  UDP packets with invalid checksums (bsc#936831).\n\nSecurity issues already fixed in the previous update but not referenced by CVE:\n- CVE-2014-9728: Kernel built with the UDF file system(CONFIG_UDF_FS)\n  support were vulnerable to a crash (bsc#933904).\n- CVE-2014-9729: Kernel built with the UDF file system(CONFIG_UDF_FS)\n  support were vulnerable to a crash (bsc#933904).\n- CVE-2014-9730: Kernel built with the UDF file system(CONFIG_UDF_FS)\n  support were vulnerable to a crash (bsc#933904).\n- CVE-2014-9731: Kernel built with the UDF file system(CONFIG_UDF_FS)\n  support were vulnerable to information leakage (bsc#933896).\n\nThe following non-security bugs were fixed:\n- ALSA: hda - add codec ID for Skylake display audio codec (bsc#936556).\n- ALSA: hda/hdmi - apply Haswell fix-ups to Skylake display codec\n  (bsc#936556).\n- ALSA: hda_controller: Separate stream_tag for input and output streams\n  (bsc#936556).\n- ALSA: hda_intel: add AZX_DCAPS_I915_POWERWELL for SKL and BSW\n  (bsc#936556).\n- ALSA: hda_intel: apply the Seperate stream_tag for Skylake\n  (bsc#936556).\n- ALSA: hda_intel: apply the Seperate stream_tag for Sunrise Point\n  (bsc#936556).\n- Btrfs: Handle unaligned length in extent_same (bsc#937609).\n- Btrfs: add missing inode item update in fallocate() (bsc#938023).\n- Btrfs: check pending chunks when shrinking fs to avoid corruption\n  (bsc#936445).\n- Btrfs: do not update mtime/ctime on deduped inodes (bsc#937616).\n- Btrfs: fix block group -\u003espace_info null pointer dereference\n  (bsc#935088).\n- Btrfs: fix clone / extent-same deadlocks (bsc#937612).\n- Btrfs: fix deadlock with extent-same and readpage (bsc#937612).\n- Btrfs: fix fsync data loss after append write (bsc#936446).\n- Btrfs: fix hang during inode eviction due to concurrent readahead\n  (bsc#935085).\n- Btrfs: fix memory leak in the extent_same ioctl (bsc#937613).\n- Btrfs: fix race when reusing stale extent buffers that leads to BUG_ON\n  (bsc#926369).\n- Btrfs: fix use after free when close_ctree frees the orphan_rsv\n  (bsc#938022).\n- Btrfs: pass unaligned length to btrfs_cmp_data() (bsc#937609).\n- Btrfs: provide super_operations-\u003einode_get_dev (bsc#927455).\n- Drivers: hv: balloon: check if ha_region_mutex was acquired in\n  MEM_CANCEL_ONLINE case.\n- Drivers: hv: fcopy: process deferred messages when we complete the\n  transaction.\n- Drivers: hv: fcopy: rename fcopy_work -\u003e fcopy_timeout_work.\n- Drivers: hv: fcopy: set .owner reference for file operations.\n- Drivers: hv: fcopy: switch to using the hvutil_device_state state\n  machine.\n- Drivers: hv: hv_balloon: correctly handle num_pages\u003eINT_MAX case.\n- Drivers: hv: hv_balloon: correctly handle val.freeram lower than num_pages case.\n- Drivers: hv: hv_balloon: do not lose memory when onlining order is not\n  natural.\n- Drivers: hv: hv_balloon: do not online pages in offline blocks.\n- Drivers: hv: hv_balloon: eliminate jumps in piecewiese linear floor\n  function.\n- Drivers: hv: hv_balloon: eliminate the trylock path in\n  acquire/release_region_mutex.\n- Drivers: hv: hv_balloon: keep locks balanced on add_memory() failure.\n- Drivers: hv: hv_balloon: refuse to balloon below the floor.\n- Drivers: hv: hv_balloon: report offline pages as being used.\n- Drivers: hv: hv_balloon: survive ballooning request with num_pages=0.\n- Drivers: hv: kvp: move poll_channel() to hyperv_vmbus.h.\n- Drivers: hv: kvp: rename kvp_work -\u003e kvp_timeout_work.\n- Drivers: hv: kvp: reset kvp_context.\n- Drivers: hv: kvp: switch to using the hvutil_device_state state\n  machine.\n- Drivers: hv: util: Fix a bug in the KVP code. reapply upstream change\n  ontop of v3.12-stable change\n- Drivers: hv: util: On device remove, close the channel after\n  de-initializing the service.\n- Drivers: hv: util: introduce hv_utils_transport abstraction.\n- Drivers: hv: util: introduce state machine for util drivers.\n- Drivers: hv: util: move kvp/vss function declarations to\n  hyperv_vmbus.h.\n- Drivers: hv: vmbus: Add device and vendor ID to vmbus devices.\n- Drivers: hv: vmbus: Add support for VMBus panic notifier handler\n  (bsc#934160).\n- Drivers: hv: vmbus: Add support for the NetworkDirect GUID.\n- Drivers: hv: vmbus: Correcting truncation error for constant\n  HV_CRASH_CTL_CRASH_NOTIFY (bsc#934160).\n- Drivers: hv: vmbus: Export the vmbus_sendpacket_pagebuffer_ctl().\n- Drivers: hv: vmbus: Fix a bug in rescind processing in\n  vmbus_close_internal().\n- Drivers: hv: vmbus: Fix a siganlling host signalling issue.\n- Drivers: hv: vmbus: Get rid of some unnecessary messages.\n- Drivers: hv: vmbus: Get rid of some unused definitions.\n- Drivers: hv: vmbus: Handle both rescind and offer messages in the same\n  context.\n- Drivers: hv: vmbus: Implement the protocol for tearing down vmbus\n  state.\n- Drivers: hv: vmbus: Introduce a function to remove a rescinded offer.\n- Drivers: hv: vmbus: Perform device register in the per-channel work\n  element.\n- Drivers: hv: vmbus: Permit sending of packets without payload.\n- Drivers: hv: vmbus: Properly handle child device remove.\n- Drivers: hv: vmbus: Remove the channel from the channel list(s) on\n  failure.\n- Drivers: hv: vmbus: Suport an API to send packet with additional\n  control.\n- Drivers: hv: vmbus: Suport an API to send pagebuffers with additional\n  control.\n- Drivers: hv: vmbus: Teardown clockevent devices on module unload.\n- Drivers: hv: vmbus: Teardown synthetic interrupt controllers on module\n  unload.\n- Drivers: hv: vmbus: Use a round-robin algorithm for picking the\n  outgoing channel.\n- Drivers: hv: vmbus: Use the vp_index map even for channels bound to CPU\n  0.\n- Drivers: hv: vmbus: avoid double kfree for device_obj.\n- Drivers: hv: vmbus: briefly comment num_sc and next_oc.\n- Drivers: hv: vmbus: decrease num_sc on subchannel removal.\n- Drivers: hv: vmbus: distribute subchannels among all vcpus.\n- Drivers: hv: vmbus: do cleanup on all vmbus_open() failure paths.\n- Drivers: hv: vmbus: introduce vmbus_acpi_remove.\n- Drivers: hv: vmbus: kill tasklets on module unload.\n- Drivers: hv: vmbus: move init_vp_index() call to vmbus_process_offer().\n- Drivers: hv: vmbus: prevent cpu offlining on newer hypervisors.\n- Drivers: hv: vmbus: rename channel work queues.\n- Drivers: hv: vmbus: teardown hv_vmbus_con workqueue and\n  vmbus_connection pages on shutdown.\n- Drivers: hv: vmbus: unify calls to percpu_channel_enq().\n- Drivers: hv: vmbus: unregister panic notifier on module unload.\n- Drivers: hv: vmbus:Update preferred vmbus protocol version to windows\n  10.\n- Drivers: hv: vss: process deferred messages when we complete the\n  transaction.\n- Drivers: hv: vss: switch to using the hvutil_device_state state\n  machine.\n- Enable CONFIG_BRIDGE_NF_EBTABLES on s390x (bsc#936012)\n- Fix connection reuse when sk_error_report is used (bsc#930972).\n- GHES: Carve out error queueing in a separate function (bsc#917630).\n- GHES: Carve out the panic functionality (bsc#917630).\n- GHES: Elliminate double-loop in the NMI handler (bsc#917630).\n- GHES: Make NMI handler have a single reader (bsc#917630).\n- GHES: Panic right after detection (bsc#917630).\n- IB/mlx4: Fix wrong usage of IPv4 protocol for multicast attach/detach\n  (bsc#918618).\n- Initialize hv_netvsc_packet-\u003exmit_more to avoid transfer stalls\n- KVM: PPC: BOOK3S: HV: CMA: Reserve cma region only in hypervisor mode\n  (bsc#908491).\n- KVM: s390: virtio-ccw: Handle command rejects (bsc#931860).\n- MODSIGN: loading keys from db when SecureBoot disabled (bsc#929696).\n- MODSIGN: loading keys from db when SecureBoot disabled (bsc#929696).\n- PCI: pciehp: Add hotplug_lock to serialize hotplug events (bsc#866911).\n- Revert 'MODSIGN: loading keys from db when SecureBoot disabled'. This\n  reverts commit b45412d4, because it breaks legacy boot.\n- SUNRPC: Report connection error values to rpc_tasks on the pending\n  queue (bsc#930972).\n- Update s390x kabi files with netfilter change (bsc#936012)\n- client MUST ignore EncryptionKeyLength if CAP_EXTENDED_SECURITY is set\n  (bsc#932348).\n- cpufreq: pcc: Enable autoload of pcc-cpufreq for ACPI processors\n  (bsc#933117).\n- dmapi: fix value from newer Linux strnlen_user() (bsc#932897).\n- drm/i915/hsw: Fix workaround for server AUX channel clock divisor\n  (bsc#935918).\n- drm/i915: Evict CS TLBs between batches (bsc#935918).\n- drm/i915: Fix DDC probe for passive adapters (bsc#935918).\n- drm/i915: Handle failure to kick out a conflicting fb driver\n  (bsc#935918).\n- drm/i915: drop WaSetupGtModeTdRowDispatch:snb (bsc#935918).\n- drm/i915: save/restore GMBUS freq across suspend/resume on gen4\n  (bsc#935918).\n- edd: support original Phoenix EDD 3.0 information (bsc#929974).\n- ext4: fix over-defensive complaint after journal abort (bsc#935174).\n- fs/cifs: Fix corrupt SMB2 ioctl requests (bsc#931124).\n- ftrace: add oco handling patch (bsc#924526).\n- ftrace: allow architectures to specify ftrace compile options\n  (bsc#924526).\n- ftrace: let notrace function attribute disable hotpatching if necessary\n  (bsc#924526).\n- hugetlb, kabi: do not account hugetlb pages as NR_FILE_PAGES\n  (bsc#930092).\n- hugetlb: do not account hugetlb pages as NR_FILE_PAGES (bsc#930092).\n- hv: channel: match var type to return type of wait_for_completion.\n- hv: do not schedule new works in\n  vmbus_onoffer()/vmbus_onoffer_rescind().\n- hv: hv_balloon: match var type to return type of wait_for_completion.\n- hv: hv_util: move vmbus_open() to a later place.\n- hv: hypervvssd: call endmntent before call setmntent again.\n- hv: no rmmod for hv_vmbus and hv_utils.\n- hv: remove the per-channel workqueue.\n- hv: run non-blocking message handlers in the dispatch tasklet.\n- hv: vmbus: missing curly braces in vmbus_process_offer().\n- hv: vmbus_free_channels(): remove the redundant free_channel().\n- hv: vmbus_open(): reset the channel state on ENOMEM.\n- hv: vmbus_post_msg: retry the hypercall on some transient errors.\n- hv_netvsc: Allocate the receive buffer from the correct NUMA node.\n- hv_netvsc: Allocate the sendbuf in a NUMA aware way.\n- hv_netvsc: Clean up two unused variables.\n- hv_netvsc: Cleanup the test for freeing skb when we use sendbuf\n  mechanism.\n- hv_netvsc: Define a macro RNDIS_AND_PPI_SIZE.\n- hv_netvsc: Eliminate memory allocation in the packet send path.\n- hv_netvsc: Fix a bug in netvsc_start_xmit().\n- hv_netvsc: Fix the packet free when it is in skb headroom.\n- hv_netvsc: Implement batching in send buffer.\n- hv_netvsc: Implement partial copy into send buffer.\n- hv_netvsc: Use the xmit_more skb flag to optimize signaling the host.\n- hv_netvsc: change member name of struct netvsc_stats.\n- hv_netvsc: introduce netif-msg into netvsc module.\n- hv_netvsc: remove unused variable in netvsc_send().\n- hv_netvsc: remove vmbus_are_subchannels_present() in\n  rndis_filter_device_add().\n- hv_netvsc: try linearizing big SKBs before dropping them.\n- hv_netvsc: use per_cpu stats to calculate TX/RX data.\n- hv_netvsc: use single existing drop path in netvsc_start_xmit.\n- hv_vmbus: Add gradually increased delay for retries in\n  vmbus_post_msg().\n- hyperv: Implement netvsc_get_channels() ethool op.\n- hyperv: hyperv_fb: match wait_for_completion_timeout return type.\n- iommu/amd: Handle integer overflow in dma_ops_area_alloc (bsc#931538).\n- iommu/amd: Handle large pages correctly in free_pagetable (bsc#935881).\n- ipr: Increase default adapter init stage change timeout (bsc#930579).\n- ipv6: do not delete previously existing ECMP routes if add fails\n  (bsc#930399).\n- ipv6: fix ECMP route replacement (bsc#930399).\n- jbd2: improve error messages for inconsistent journal heads\n  (bsc#935174).\n- jbd2: revise KERN_EMERG error messages (bsc#935174).\n- kabi/severities: Add s390 symbols allowed to change in bsc#931860\n- kabi: only use sops-\u003eget_inode_dev with proper fsflag.\n- kernel: add panic_on_warn.\n- kexec: allocate the kexec control page with KEXEC_CONTROL_MEMORY_GFP\n  (bsc#928131).\n- kgr: fix redirection on s390x arch (bsc#903279).\n- kgr: move kgr_task_in_progress() to sched.h.\n- kgr: send a fake signal to all blocking tasks.\n- kvm: irqchip: Break up high order allocations of kvm_irq_routing_table\n  (bsc#926953).\n- libata: Blacklist queued TRIM on all Samsung 800-series (bsc#930599).\n- mei: bus: () can be static.\n- mm, thp: really limit transparent hugepage allocation to local node (VM\n  Performance, bsc#931620).\n- mm, thp: respect MPOL_PREFERRED policy with non-local node (VM\n  Performance, bsc#931620).\n- mm/mempolicy.c: merge alloc_hugepage_vma to alloc_pages_vma (VM\n  Performance, bsc#931620).\n- mm/thp: allocate transparent hugepages on local node (VM Performance,\n  bsc#931620).\n- net/mlx4_en: Call register_netdevice in the proper location\n  (bsc#858727).\n- net/mlx4_en: Do not attempt to TX offload the outer UDP checksum for\n  VXLAN (bsc#858727).\n- net: fib6: fib6_commit_metrics: fix potential NULL pointer dereference\n  (bsc#867362).\n- net: introduce netdev_alloc_pcpu_stats() for drivers.\n- net: ipv6: fib: do not sleep inside atomic lock (bsc#867362).\n- netdev: set __percpu attribute on netdev_alloc_pcpu_stats.\n- netdev_alloc_pcpu_stats: use less common iterator variable.\n- netfilter: xt_NFQUEUE: fix --queue-bypass regression (bsc#935083)\n- ovl: default permissions (bsc#924071).\n- ovl: move s_stack_depth .\n- powerpc/perf/hv-24x7: use kmem_cache instead of aligned stack\n  allocations (bsc#931403).\n- powerpc/pseries: Correct cpu affinity for dlpar added cpus (bsc#932967).\n- powerpc: Add VM_FAULT_HWPOISON handling to powerpc page fault handler\n  (bsc#929475).\n- powerpc: Fill in si_addr_lsb siginfo field (bsc#929475).\n- powerpc: Simplify do_sigbus (bsc#929475).\n- reiserfs: Fix use after free in journal teardown (bsc#927697).\n- rtlwifi: rtl8192cu: Fix kernel deadlock (bsc#927786).\n- s390/airq: add support for irq ranges (bsc#931860).\n- s390/airq: silence lockdep warning (bsc#931860).\n- s390/compat,signal: change return values to -EFAULT (bsc#929879).\n- s390/ftrace: hotpatch support for function tracing (bsc#924526).\n- s390/irq: improve displayed interrupt order in /proc/interrupts\n  (bsc#931860).\n- s390/kernel: use stnsm 255 instead of stosm 0 (bsc#929879).\n- s390/kgr: reorganize kgr infrastructure in entry64.S.\n- s390/mm: align 64-bit PIE binaries to 4GB (bsc#929879).\n- s390/mm: limit STACK_RND_MASK for compat tasks (bsc#929879).\n- s390/rwlock: add missing local_irq_restore calls (bsc#929879).\n- s390/sclp_vt220: Fix kernel panic due to early terminal input\n  (bsc#931860).\n- s390/smp: only send external call ipi if needed (bsc#929879).\n- s390/spinlock,rwlock: always to a load-and-test first (bsc#929879).\n- s390/spinlock: cleanup spinlock code (bsc#929879).\n- s390/spinlock: optimize spin_unlock code (bsc#929879).\n- s390/spinlock: optimize spinlock code sequence (bsc#929879).\n- s390/spinlock: refactor arch_spin_lock_wait[_flags] (bsc#929879).\n- s390/time: use stck clock fast for do_account_vtime (bsc#929879).\n- s390: Remove zfcpdump NR_CPUS dependency (bsc#929879).\n- s390: add z13 code generation support (bsc#929879).\n- s390: avoid z13 cache aliasing (bsc#929879).\n- s390: fix control register update (bsc#929879).\n- s390: optimize control register update (bsc#929879).\n- s390: z13 base performance (bsc#929879).\n- sched: fix __sched_setscheduler() vs load balancing race (bsc#921430)\n- scsi: retry MODE SENSE on unit attention (bsc#895814).\n- scsi_dh_alua: Recheck state on unit attention (bsc#895814).\n- scsi_dh_alua: fixup crash in alua_rtpg_work() (bsc#895814).\n- scsi_dh_alua: parse device id instead of target id (bsc#895814).\n- scsi_dh_alua: recheck RTPG in regular intervals (bsc#895814).\n- scsi_dh_alua: update all port states (bsc#895814).\n- sd: always retry READ CAPACITY for ALUA state transition (bsc#895814).\n- st: null pointer dereference panic caused by use after kref_put by\n  st_open (bsc#936875).\n- supported.conf: add btrfs to kernel-$flavor-base (bsc#933637)\n- udf: Remove repeated loads blocksize (bsc#933907).\n- usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub\n  port reset (bsc#938024).\n- vTPM: set virtual device before passing to ibmvtpm_reset_crq\n  (bsc#937087).\n- vfs: add super_operations-\u003eget_inode_dev (bsc#927455).\n- virtio-ccw: virtio-ccw adapter interrupt support (bsc#931860).\n- virtio-rng: do not crash if virtqueue is broken (bsc#931860).\n- virtio: fail adding buffer on broken queues (bsc#931860).\n- virtio: virtio_break_device() to mark all virtqueues broken\n  (bsc#931860).\n- virtio_blk: verify if queue is broken after virtqueue_get_buf()\n  (bsc#931860).\n- virtio_ccw: fix hang in set offline processing (bsc#931860).\n- virtio_ccw: fix vcdev pointer handling issues (bsc#931860).\n- virtio_ccw: introduce device_lost in virtio_ccw_device (bsc#931860).\n- virtio_net: do not crash if virtqueue is broken (bsc#931860).\n- virtio_net: verify if queue is broken after virtqueue_get_buf()\n  (bsc#931860).\n- virtio_ring: adapt to notify() returning bool (bsc#931860).\n- virtio_ring: add new function virtqueue_is_broken() (bsc#931860).\n- virtio_ring: change host notification API (bsc#931860).\n- virtio_ring: let virtqueue_{kick()/notify()} return a bool\n  (bsc#931860).\n- virtio_ring: plug kmemleak false positive (bsc#931860).\n- virtio_scsi: do not call virtqueue_add_sgs(... GFP_NOIO) holding\n  spinlock (bsc#931860).\n- virtio_scsi: verify if queue is broken after virtqueue_get_buf()\n  (bsc#931860).\n- vmxnet3: Bump up driver version number (bsc#936423).\n- vmxnet3: Changes for vmxnet3 adapter version 2 (fwd) (bug#936423).\n- vmxnet3: Fix memory leaks in rx path (fwd) (bug#936423).\n- vmxnet3: Register shutdown handler for device (fwd) (bug#936423).\n- x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A\n  (bsc#907092).\n- x86/PCI: Use host bridge _CRS info on systems with \u003e32 bit addressing\n  (bsc#907092).\n- x86/kgr: move kgr infrastructure from asm to C.\n- x86/mm: Improve AMD Bulldozer ASLR workaround (bsc#937032).\n- xfrm: release dst_orig in case of error in xfrm_lookup() (bsc#932793).\n- xfs: Skip dirty pages in -\u003ereleasepage (bsc#915183).\n- xfs: fix xfs_setattr for DMAPI (bsc#932900).\n- xfs_dmapi: fix transaction ilocks (bsc#932899).\n- xfs_dmapi: fix value from newer Linux strnlen_user() (bsc#932897).\n- xfs_dmapi: xfs_dm_rdwr() uses dir file ops not file's ops (bsc#932898).\n","status":"published","published":"2015-07-16T14:57:20Z","modified":"2026-02-04T03:21:11.873218Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2015-4692","description":"The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.","status":"published","published":"2015-06-22T00:00:00Z","modified":"2026-04-22T10:12:02.647837Z","updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"USN-2681-1","title":"linux vulnerabilities","description":"\nA flaw was discovered in the user space memory copying for the pipe iovecs\nin the Linux kernel. An unprivileged local user could exploit this flaw to\ncause a denial of service (system crash) or potentially escalate their\nprivileges. (CVE-2015-1805)\n\nA flaw was discovered in the kvm (kernel virtual machine) subsystem's\nkvm_apic_has_events function. A unprivileged local user could exploit this\nflaw to cause a denial of service (system crash). (CVE-2015-4692)\n\nDaniel Borkmann reported a kernel crash in the Linux kernel's BPF filter\nJIT optimization. A local attacker could exploit this flaw to cause a\ndenial of service (system crash). (CVE-2015-4700)\n\nA flaw was discovered in how the Linux kernel handles invalid UDP\nchecksums. A remote attacker could exploit this flaw to cause a denial of\nservice using a flood of UDP packets with invalid checksums.\n(CVE-2015-5364)\n\nA flaw was discovered in how the Linux kernel handles invalid UDP\nchecksums. A remote attacker can cause a denial of service against\napplications that use epoll by injecting a single packet with an invalid\nchecksum. (CVE-2015-5366)\n\nA double free flaw was discovered in the Linux kernel's path lookup. A\nlocal user could cause a denial of service (Oops). (CVE-2015-5706)\n","status":"published","published":"2015-07-23T23:25:36Z","modified":"2026-04-22T09:14:10.580862Z","updated_at":"2026-11-02T16:58:09.227524Z"},{"id":"USN-2682-1","title":"linux-lts-utopic vulnerabilities","description":"A flaw was discovered in the kvm (kernel virtual machine) subsystem's\nkvm_apic_has_events function. A unprivileged local user could exploit this\nflaw to cause a denial of service (system crash). (CVE-2015-4692)\n\nA flaw was discovered in how the Linux kernel handles invalid UDP\nchecksums. A remote attacker could exploit this flaw to cause a denial of\nservice using a flood of UDP packets with invalid checksums.\n(CVE-2015-5364)\n\nA flaw was discovered in how the Linux kernel handles invalid UDP\nchecksums. A remote attacker can cause a denial of service against\napplications that use epoll by injecting a single packet with an invalid\nchecksum. (CVE-2015-5366)\n","status":"published","published":"2015-07-23T23:50:35Z","modified":"2026-02-10T04:40:55Z","updated_at":"2026-11-02T16:58:09.227524Z"},{"id":"USN-2683-1","title":"linux-lts-vivid vulnerabilities","description":"A flaw was discovered in the kvm (kernel virtual machine) subsystem's\nkvm_apic_has_events function. A unprivileged local user could exploit this\nflaw to cause a denial of service (system crash). (CVE-2015-4692)\n\nDaniel Borkmann reported a kernel crash in the Linux kernel's BPF filter\nJIT optimization. A local attacker could exploit this flaw to cause a\ndenial of service (system crash). (CVE-2015-4700)\n\nA flaw was discovered in how the Linux kernel handles invalid UDP\nchecksums. A remote attacker could exploit this flaw to cause a denial of\nservice using a flood of UDP packets with invalid checksums.\n(CVE-2015-5364)\n\nA flaw was discovered in how the Linux kernel handles invalid UDP\nchecksums. A remote attacker can cause a denial of service against\napplications that use epoll by injecting a single packet with an invalid\nchecksum. (CVE-2015-5366)\n","status":"published","published":"2015-07-23T23:53:20Z","modified":"2026-02-10T04:40:55Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}