{"id":"CVE-2015-5706","aliases":["DEBIAN-CVE-2015-5706","EUVD-2015-5653","GHSA-2g53-3pj8-qvxv","MGASA-2015-0386","MGASA-2015-0390","MGASA-2016-0015","UBUNTU-CVE-2015-5706","USN-2664-1","USN-2665-1","USN-2681-1"],"status":"published","title":"Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x...","description":"Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.","severity":{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00436,"percentile":0.38104,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2015-07-07T09:41:40Z","modified":"2026-09-09T06:47:28Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.0.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-58.97"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","fixed_in":["3.16.0-43.58~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","fixed_in":["3.19.0-22.22~14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.4-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20150722-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"btrfs-progs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"iproute2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-1.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-4.mga5"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-firmware-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20150824-1.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"radeon-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20150824-1.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-broadcom-wl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.30.223.248-36.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-fglrx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.200.1046-5.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"nvidia304","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"304.125-5.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-nvidia304","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"304.125-41.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"nvidia340","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"340.76-2.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-nvidia340","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"340.76-31.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-nvidia-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"346.82-3.mga5.nonfree"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-1.mga5"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.15-1.mga5"}]}],"bundled":22},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-58.97"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-43.58~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1","3.16.0-33.44~14.04.1","3.16.0-34.45~14.04.1","3.16.0-34.47~14.04.1","3.16.0-36.48~14.04.1","3.16.0-37.49~14.04.1","3.16.0-37.51~14.04.1","3.16.0-38.52~14.04.1","3.16.0-39.53~14.04.1","3.16.0-40.54~14.04.1","3.16.0-41.55~14.04.1","3.16.0-41.57~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-22.22~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1","3.19.0-20.20~14.04.1","3.19.0-21.21~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-43.58~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1","3.16.0-33.44~14.04.1","3.16.0-34.45~14.04.1","3.16.0-34.47~14.04.1","3.16.0-36.48~14.04.1","3.16.0-37.49~14.04.1","3.16.0-37.51~14.04.1","3.16.0-38.52~14.04.1","3.16.0-39.53~14.04.1","3.16.0-40.54~14.04.1","3.16.0-41.55~14.04.1","3.16.0-41.57~14.04.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-22.22~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1","3.19.0-20.20~14.04.1","3.19.0-21.21~14.04.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-58.97"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95"],"bundled":6}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://source.android.com/security/bulletin/2017-01-01.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://twitter.com/grsecurity/statuses/597127122910490624","tags":["x_refsource_MISC","x_transferred","Broken Link","web"]},{"url":"http://www.ubuntu.com/usn/USN-2680-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.4","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1250047","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/76142","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3329","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/torvalds/linux/commit/f15133df088ecadd141ea1907f2c96df67c729f0","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f15133df088ecadd141ea1907f2c96df67c729f0","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.ubuntu.com/usn/USN-2681-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/08/01/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5706"},{"url":"https://github.com/advisories/GHSA-2g53-3pj8-qvxv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-5706","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0386.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16655","tags":["report"]},{"url":"http://kernelnewbies.org/Linux_4.0","tags":["web"]},{"url":"http://kernelnewbies.org/Linux_4.1","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.1","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.2","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.3","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.5","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.6","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.7","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.8","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0390.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16654","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2016-0015.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17401","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16915","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17010","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17034","tags":["report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.9","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.10","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.11","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.12","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.13","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.14","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.15","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-5706","tags":["report"]},{"url":"https://twitter.com/grsecurity/status/597127122910490624","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2664-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2665-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2667-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2680-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2681-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-4001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-4002","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-4003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-4167","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-4700","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-4692","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5366","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-5706","description":"Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.","status":"published","published":"2015-08-31T10:00:00Z","modified":"2024-08-06T06:59:03.985Z","updated_at":"2026-11-02T14:35:39.447402Z"}],"euvd":[{"id":"EUVD-2015-5653","description":"Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.","status":"published","published":"2015-08-31T10:00:00Z","modified":"2024-08-06T06:59:03Z","updated_at":"2026-11-03T02:21:59.31515Z"}],"ghsa":[{"id":"GHSA-2g53-3pj8-qvxv","title":"Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x...","description":"Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.","status":"published","published":"2022-05-13T01:23:45Z","modified":"2023-02-01T05:07:12Z","cwes":["CWE-416"],"updated_at":"2026-11-02T14:50:30.001937Z"}],"nvd":[{"id":"CVE-2015-5706","description":"Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.","status":"published","published":"2015-08-31T10:59:16.08Z","modified":"2026-06-17T00:29:37.79Z","cvss":[{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:03:08.998581Z"}],"osv":[{"id":"CVE-2015-5706","description":"Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.","status":"published","published":"2015-08-31T10:59:16Z","modified":"2026-04-16T06:22:30.187998932Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-5706","description":"Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.","status":"published","published":"2015-08-31T10:59:16.08Z","modified":"2026-09-09T06:47:28.360788621Z","updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"MGASA-2015-0386","title":"Updated kernel packages provides 4.1 longterm and fixes security issues","description":"This kernel update provides an upgrade to the upstream 4.1 longterm kernel\nseries, currently based on 4.1.8 and resolves at least the following\nsecurity issues:\n\nIt was found that the Linux kernel's keyring implementation would leak\nmemory when adding a key to a keyring via the add_key() function. A\nlocal attacker could use this flaw to exhaust all available memory on\nthe system. (CVE-2015-1333)\n\nA flaw was found in the Linux kernel where the deletion of a file or\ndirectory could trigger an unmount and reveal data under a mount point.\nThis flaw was inadvertently introduced with the new feature of being able\nto lazily unmount a mount tree when using file system user namespaces.\n(CVE-2015-4176)\n\nA flaw was discovered in the kernel's collect_mounts function. If the kernel\naudit subsystem called collect_mounts to audit an unmounted path, it could\npanic the system. With this flaw, an unprivileged user could call umount\n(MNT_DETACH) to launch a denial-of-service attack. (CVE-2015-4177)\n\nA flaw was found in the Linux kernel which is related to the user namespace\nlazily unmounting file systems. The fs_pin struct has two members (m_list\nand s_list) which are usually initialized on use in the pin_insert_group\nfunction. However, these members might go unmodified; in this case, the\nsystem panics when it attempts to destroy or free them. This flaw could be\nused to launch a denial-of-service attack. (CVE-2015-4178)\n\nA DoS flaw was found for a Linux kernel built for the x86 architecture which\nhad the KVM virtualization support(CONFIG_KVM) enabled. The kernel would be\nvulnerable to a NULL pointer dereference flaw in Linux kernel's\nkvm_apic_has_events() function while doing an ioctl. An unprivileged user\nable to access the \"/dev/kvm\" device could use this flaw to crash the system\nkernel. (CVE-2015-4692)\n\nA flaw was found in the kernel's implementation of the Berkeley Packet\nFilter (BPF). A local attacker could craft BPF code to crash the system\nby creating a situation in which the JIT compiler would fail to correctly\noptimize the JIT image on the last pass. This would lead to the CPU\nexecuting instructions that were not part of the JIT code. (CVE-2015-4700)\n\nThe get_bitmap_file function in drivers/md/md.c in the Linux kernel before\n4.1.6 does not initialize a certain bitmap data structure, which allows\nlocal users to obtain sensitive information from kernel memory via a\nGET_BITMAP_FILE ioctl call. (CVE-2015-5697)\n\nUse-after-free vulnerability in the path_openat function in fs/namei.c in\nthe Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a\ndenial of service or possibly have unspecified other impact via O_TMPFILE\nfilesystem operations that leverage a duplicate cleanup operation.\n(CVE-2015-5706)\n\nIt was discovered that an integer overflow error existed in the SCSIgeneric\n(sg) driver in the Linux kernel. A local attacker with writepermission to a\nSCSI generic device could use this to cause a denial of service (system\ncrash) or potentially escalate their privileges. (CVE-2015-5707)\n\nAdditionally the following packages have been updated to add or improve \nsupport for the 4.1 series kernels: btrfs-progs, iproute2, xtables-addons,\nnvidia304, nvidia340, kernel-firmware-nonfree, radeon-firmware.\n\nFor other changes, see the referenced changelogs:\n","status":"published","published":"2015-09-30T21:35:18Z","modified":"2026-04-16T06:23:54.800942025Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"MGASA-2015-0390","title":"Updated kernel-linus package provides 4.1 longterm and fixes security issues","description":"This kernel-linus update provides an upgrade to the upstream 4.1 longterm\nkernel series, currently based on 4.1.8 and resolves at least the following\nsecurity issues:\n\nIt was found that the Linux kernel's keyring implementation would leak\nmemory when adding a key to a keyring via the add_key() function. A\nlocal attacker could use this flaw to exhaust all available memory on\nthe system. (CVE-2015-1333)\n\nA flaw was found in the Linux kernel where the deletion of a file or\ndirectory could trigger an unmount and reveal data under a mount point.\nThis flaw was inadvertently introduced with the new feature of being able\nto lazily unmount a mount tree when using file system user namespaces.\n(CVE-2015-4176)\n\nA flaw was discovered in the kernel's collect_mounts function. If the kernel\naudit subsystem called collect_mounts to audit an unmounted path, it could\npanic the system. With this flaw, an unprivileged user could call umount\n(MNT_DETACH) to launch a denial-of-service attack. (CVE-2015-4177)\n\nA flaw was found in the Linux kernel which is related to the user namespace\nlazily unmounting file systems. The fs_pin struct has two members (m_list\nand s_list) which are usually initialized on use in the pin_insert_group\nfunction. However, these members might go unmodified; in this case, the\nsystem panics when it attempts to destroy or free them. This flaw could be\nused to launch a denial-of-service attack. (CVE-2015-4178)\n\nA DoS flaw was found for a Linux kernel built for the x86 architecture which\nhad the KVM virtualization support(CONFIG_KVM) enabled. The kernel would be\nvulnerable to a NULL pointer dereference flaw in Linux kernel's\nkvm_apic_has_events() function while doing an ioctl. An unprivileged user\nable to access the \"/dev/kvm\" device could use this flaw to crash the system\nkernel. (CVE-2015-4692)\n\nA flaw was found in the kernel's implementation of the Berkeley Packet\nFilter (BPF). A local attacker could craft BPF code to crash the system\nby creating a situation in which the JIT compiler would fail to correctly\noptimize the JIT image on the last pass. This would lead to the CPU\nexecuting instructions that were not part of the JIT code. (CVE-2015-4700)\n\nThe get_bitmap_file function in drivers/md/md.c in the Linux kernel before\n4.1.6 does not initialize a certain bitmap data structure, which allows\nlocal users to obtain sensitive information from kernel memory via a\nGET_BITMAP_FILE ioctl call. (CVE-2015-5697)\n\nUse-after-free vulnerability in the path_openat function in fs/namei.c in\nthe Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a\ndenial of service or possibly have unspecified other impact via O_TMPFILE\nfilesystem operations that leverage a duplicate cleanup operation.\n(CVE-2015-5706)\n\nIt was discovered that an integer overflow error existed in the SCSIgeneric\n(sg) driver in the Linux kernel. A local attacker with writepermission to a\nSCSI generic device could use this to cause a denial of service (system\ncrash) or potentially escalate their privileges. (CVE-2015-5707)\n\nFor other changes, see the referenced changelogs:\n","status":"published","published":"2015-10-09T18:47:39Z","modified":"2026-04-16T06:22:39.105102835Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"MGASA-2016-0015","title":"Updated kernel-tmb packages provides 4.1 longterm kernel and fixes security issues","description":"This kernel-tmb update provides an upgrade to the upstream 4.1 longterm\nkernel series, currently based on 4.1.15 and resolves at least the\nfollowing security issues:\n\nIt was found that the Linux kernel's keyring implementation would leak\nmemory when adding a key to a keyring via the add_key() function. A\nlocal attacker could use this flaw to exhaust all available memory on\nthe system. (CVE-2015-1333)\n\nA flaw was found in the Linux kernel where the deletion of a file or\ndirectory could trigger an unmount and reveal data under a mount point.\nThis flaw was inadvertently introduced with the new feature of being able\nto lazily unmount a mount tree when using file system user namespaces.\n(CVE-2015-4176)\n\nA flaw was discovered in the kernel's collect_mounts function. If the kernel\naudit subsystem called collect_mounts to audit an unmounted path, it could\npanic the system. With this flaw, an unprivileged user could call umount\n(MNT_DETACH) to launch a denial-of-service attack. (CVE-2015-4177)\n\nA flaw was found in the Linux kernel which is related to the user namespace\nlazily unmounting file systems. The fs_pin struct has two members (m_list\nand s_list) which are usually initialized on use in the pin_insert_group\nfunction. However, these members might go unmodified; in this case, the\nsystem panics when it attempts to destroy or free them. This flaw could be\nused to launch a denial-of-service attack. (CVE-2015-4178)\n\nA DoS flaw was found for a Linux kernel built for the x86 architecture which\nhad the KVM virtualization support(CONFIG_KVM) enabled. The kernel would be\nvulnerable to a NULL pointer dereference flaw in Linux kernel's\nkvm_apic_has_events() function while doing an ioctl. An unprivileged user\nable to access the \"/dev/kvm\" device could use this flaw to crash the system\nkernel. (CVE-2015-4692)\n\nA flaw was found in the kernel's implementation of the Berkeley Packet\nFilter (BPF). A local attacker could craft BPF code to crash the system\nby creating a situation in which the JIT compiler would fail to correctly\noptimize the JIT image on the last pass. This would lead to the CPU\nexecuting instructions that were not part of the JIT code. (CVE-2015-4700)\n\nThe virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel\nbefore 4.2 attempts to support a FRAGLIST feature without proper memory\nallocation, which allows guest OS users to cause a denial of service (buffer\noverflow and memory corruption) via a crafted sequence of fragmented packets.\n(CVE-2015-5156)\n\nMoein Ghasemzadeh discovered that the USB WhiteHEAT serial driver contained\nhardcoded attributes about the USB devices. An attacker could construct a\nfake WhiteHEAT USB device that, when inserted, causes a denial of service\n(system crash) (CVE-2015-5257).\n\nA guest to host DoS issue was found affecting various hypervisors. In that,\na guest can DoS the host by triggering an infinite stream of \"alignment\ncheck\" (#AC) exceptions. This causes the microcode to enter an infinite loop\nwhere the core never receives another interrupt. The host kernel panics due\nto this effect (CVE-2015-5307).\n\nThe get_bitmap_file function in drivers/md/md.c in the Linux kernel before\n4.1.6 does not initialize a certain bitmap data structure, which allows\nlocal users to obtain sensitive information from kernel memory via a\nGET_BITMAP_FILE ioctl call. (CVE-2015-5697)\n\nUse-after-free vulnerability in the path_openat function in fs/namei.c in\nthe Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a\ndenial of service or possibly have unspecified other impact via O_TMPFILE\nfilesystem operations that leverage a duplicate cleanup operation.\n(CVE-2015-5706)\n\nIt was discovered that an integer overflow error existed in the SCSIgeneric\n(sg) driver in the Linux kernel. A local attacker with writepermission to a\nSCSI generic device could use this to cause a denial of service (system\ncrash) or potentially escalate their privileges. (CVE-2015-5707)\n\nThe __rds_conn_create function in net/rds/connection.c in the Linux kernel\nthrough 4.2.3 allows local users to cause a denial of service (NULL pointer\ndereference and system crash) or possibly have unspecified other impact by\nusing a socket that was not properly bound (CVE-2015-6937).\n\nThe key_gc_unused_keys function in security/keys/gc.c in the Linux kernel\nthrough 4.2.6 allows local users to cause a denial of service (OOPS) via\ncrafted keyctl commands (CVE-2015-7872).\n\nThe vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in\nthe Linux kernel through 4.3.3 does not initialize a certain structure\nmember, which allows local users to obtain sensitive information from\nkernel memory via a crafted application (CVE-2015-7884).\n\nThe dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the\nLinux kernel through 4.3.3 does not initialize a certain structure member,\nwhich allows local users to obtain sensitive information from kernel memory\nvia a crafted application (CVE-2015-7885).\n\nA guest to host DoS issue was found affecting various hypervisors. In that,\na guest can DoS the host by triggering an infinite stream of \"debug check\"\n(#DB) exceptions. This causes the microcode to enter an infinite loop where\nthe core never receives another interrupt. The host kernel panics due to\nthis effect (CVE-2015-8104).\n\nFelix Wilhelm discovered a race condition in the Xen paravirtualized\ndrivers which can cause double fetch vulnerabilities. An attacker in the\nparavirtualized guest could exploit this flaw to cause a denial of service\n(crash the host) or potentially execute arbitrary code on the host\n(CVE-2015-8550 / XSA-155).\n\nKonrad Rzeszutek Wilk discovered the Xen PCI backend driver does not\nperform sanity checks on the device's state. An attacker could exploit\nthis flaw to cause a denial of service (NULL dereference) on the host\n(CVE-2015-8551 / XSA-157).\n\nKonrad Rzeszutek Wilk discovered the Xen PCI backend driver does not\nperform sanity checks on the device's state. An attacker could exploit\nthis flaw to cause a denial of service by flooding the logging system\nwith WARN() messages causing the initial domain to exhaust disk space\n(CVE-2015-8552 / XSA-157).\n\nThe ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel\nthrough 4.3.3 attempts to merge distinct setattr operations, which allows\nlocal users to bypass intended access restrictions and modify the\nattributes of arbitrary overlay files via a crafted application\n(CVE-2015-8660).\n\nFor other upstream fixes, see the referenced changelogs.\n\nOther fixes in this update:\n* improve ath10k (QCA99X0, QCA988X, QCA6174) support (mga#16915)\n* silence a harmless warning on 32bit non-dt hardware (mga#17010)\n* fix regression with AlpsPS/2 ALPS DualPoint TouchPad of a Dell\n  Latitude D600 (mga#17034)\n","status":"published","published":"2016-01-14T01:44:39Z","modified":"2026-04-16T06:23:47.399673436Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"UBUNTU-CVE-2015-5706","description":"Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.","status":"published","published":"2015-08-03T00:00:00Z","modified":"2026-04-22T10:14:45.076623Z","updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"USN-2664-1","title":"linux-lts-utopic vulnerabilities","description":"\nA race condition was discovered in the Linux kernel's file_handle size\nverification. A local user could exploit this flaw to read potentially\nsensative memory locations. (CVE-2015-1420)\n\nA underflow error was discovered in the Linux kernel's Ozmo Devices USB\nover WiFi host controller driver. A remote attacker could exploit this flaw\nto cause a denial of service (system crash) or potentially execute\narbitrary code via a specially crafted packet. (CVE-2015-4001)\n\nA bounds check error was discovered in the Linux kernel's Ozmo Devices USB\nover WiFi host controller driver. A remote attacker could exploit this flaw\nto cause a denial of service (system crash) or potentially execute\narbitrary code via a specially crafted packet. (CVE-2015-4002)\n\nA division by zero error was discovered in the Linux kernel's Ozmo Devices\nUSB over WiFi host controller driver. A remote attacker could exploit this\nflaw to cause a denial of service (system crash). (CVE-2015-4003)\n\nCarl H Lunde discovered missing consistency checks in the Linux kernel's UDF\nfile system (CONFIG_UDF_FS). A local attacker could exploit this flaw to cause\na denial of service (system crash) by using a corrupted file system image.\n(CVE-2015-4167)\n\nDaniel Borkmann reported a kernel crash in the Linux kernel's BPF filter\nJIT optimization. A local attacker could exploit this flaw to cause a\ndenial of service (system crash). (CVE-2015-4700)\n\nA double free flaw was discovered in the Linux kernel's path lookup. A\nlocal user could cause a denial of service (Oops). (CVE-2015-5706)\n","status":"published","published":"2015-07-07T09:41:40Z","modified":"2026-02-10T04:40:54Z","updated_at":"2026-11-02T16:58:09.227524Z"},{"id":"USN-2665-1","title":"linux-lts-vivid vulnerabilities","description":"\nA race condition was discovered in the Linux kernel's file_handle size\nverification. A local user could exploit this flaw to read potentially\nsensative memory locations. (CVE-2015-1420)\n\nA underflow error was discovered in the Linux kernel's Ozmo Devices USB\nover WiFi host controller driver. A remote attacker could exploit this flaw\nto cause a denial of service (system crash) or potentially execute\narbitrary code via a specially crafted packet. (CVE-2015-4001)\n\nA bounds check error was discovered in the Linux kernel's Ozmo Devices USB\nover WiFi host controller driver. A remote attacker could exploit this flaw\nto cause a denial of service (system crash) or potentially execute\narbitrary code via a specially crafted packet. (CVE-2015-4002)\n\nA division by zero error was discovered in the Linux kernel's Ozmo Devices\nUSB over WiFi host controller driver. A remote attacker could exploit this\nflaw to cause a denial of service (system crash). (CVE-2015-4003)\n\nA double free flaw was discovered in the Linux kernel's path lookup. A\nlocal user could cause a denial of service (Oops). (CVE-2015-5706)\n","status":"published","published":"2015-07-07T09:44:09Z","modified":"2026-02-10T04:40:54Z","updated_at":"2026-11-02T16:58:09.227524Z"},{"id":"USN-2681-1","title":"linux vulnerabilities","description":"\nA flaw was discovered in the user space memory copying for the pipe iovecs\nin the Linux kernel. An unprivileged local user could exploit this flaw to\ncause a denial of service (system crash) or potentially escalate their\nprivileges. (CVE-2015-1805)\n\nA flaw was discovered in the kvm (kernel virtual machine) subsystem's\nkvm_apic_has_events function. A unprivileged local user could exploit this\nflaw to cause a denial of service (system crash). (CVE-2015-4692)\n\nDaniel Borkmann reported a kernel crash in the Linux kernel's BPF filter\nJIT optimization. A local attacker could exploit this flaw to cause a\ndenial of service (system crash). (CVE-2015-4700)\n\nA flaw was discovered in how the Linux kernel handles invalid UDP\nchecksums. A remote attacker could exploit this flaw to cause a denial of\nservice using a flood of UDP packets with invalid checksums.\n(CVE-2015-5364)\n\nA flaw was discovered in how the Linux kernel handles invalid UDP\nchecksums. A remote attacker can cause a denial of service against\napplications that use epoll by injecting a single packet with an invalid\nchecksum. (CVE-2015-5366)\n\nA double free flaw was discovered in the Linux kernel's path lookup. A\nlocal user could cause a denial of service (Oops). (CVE-2015-5706)\n","status":"published","published":"2015-07-23T23:25:36Z","modified":"2026-04-22T09:14:10.580862Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}