{"id":"CVE-2016-10044","aliases":["CLSA-2025-1757693980","CLSA-2025-1757698145","CLSA-2025-1757967705","DEBIAN-CVE-2016-10044","EUVD-2016-1239","GHSA-mm9p-48xr-prf2","SUSE-SU-2017:1247-1","SUSE-SU-2017:1360-1","UBUNTU-CVE-2016-10044","USN-3422-1"],"status":"published","title":"The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict...","description":"The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00301,"percentile":0.22926,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2017-02-07T00:00:00Z","modified":"2026-10-28T08:17:20Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.7.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.7.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.7.8-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-132.181"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","fixed_in":["4.4.0-47.68~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux","fixed_in":["4.4.0-47.68"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","fixed_in":["4.4.0-1038.45"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","fixed_in":["4.4.0-1035.39"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"bpftool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.136.1.el7.tuxcare.els24"}]}],"bundled":40},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.136.1.el7.tuxcare.els24"}]}],"bundled":40},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.136.1.el7.tuxcare.els24"}]}],"bundled":40},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.136.1.el7.tuxcare.els24"}]}],"bundled":40},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.136.1.el7.tuxcare.els24"}]}],"bundled":40},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.136.1.el7.tuxcare.els24"}]}],"bundled":40},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.136.1.el7.tuxcare.els24"}]}],"bundled":40},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.136.1.el7.tuxcare.els24"}]}],"bundled":40},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.136.1.el7.tuxcare.els24"}]}],"bundled":40},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.136.1.el7.tuxcare.els24"}]}],"bundled":40},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.136.1.el7.tuxcare.els24"}]}],"bundled":40},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"bpftool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.0.5.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.0.5.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.0.5.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.0.5.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.0.5.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.0.5.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.0.5.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.0.5.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.0.5.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.0.5.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.0.5.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"bpftool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"kernel-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"kernel-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"kernel-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"kernel-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"kernel-tools-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"kernel-tools-libs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"python-perf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-1160.119.1.el7.tuxcare.els24"}]}],"bundled":42},{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.8-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kgraft-patch-SLE12_Update_21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.72.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kgraft-patch-SLE12_Update_21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.1"}]}],"bundled":25},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12","package":"kgraft-patch-SLE12-SP1_Update_15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-4.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.4"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.40.1"}]}],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-132.181"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121","3.13.0-79.123","3.13.0-83.127","3.13.0-85.129","3.13.0-86.130","3.13.0-86.131","3.13.0-87.133","3.13.0-88.135","3.13.0-91.138","3.13.0-92.139","3.13.0-93.140","3.13.0-95.142","3.13.0-96.143","3.13.0-98.145","3.13.0-100.147","3.13.0-101.148","3.13.0-103.150","3.13.0-105.152","3.13.0-106.153","3.13.0-107.154","3.13.0-108.155","3.13.0-109.156","3.13.0-110.157","3.13.0-111.158","3.13.0-112.159","3.13.0-113.160","3.13.0-115.162","3.13.0-116.163","3.13.0-117.164","3.13.0-119.166","3.13.0-121.170","3.13.0-123.172","3.13.0-125.174","3.13.0-126.175","3.13.0-128.177","3.13.0-129.178"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-47.68~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1","4.4.0-36.55~14.04.1","4.4.0-38.57~14.04.1","4.4.0-42.62~14.04.1","4.4.0-45.66~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-47.68"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53","4.4.0-36.55","4.4.0-38.57","4.4.0-42.62","4.4.0-43.63","4.4.0-45.66"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1038.45"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16","4.4.0-1016.22","4.4.0-1017.23","4.4.0-1019.25","4.4.0-1021.27","4.4.0-1023.29","4.4.0-1027.33","4.4.0-1029.36","4.4.0-1034.41"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1035.39"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18","4.4.0-1019.22","4.4.0-1020.23","4.4.0-1022.25","4.4.0-1024.27","4.4.0-1026.29","4.4.0-1030.33","4.4.0-1032.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"linux-azure-fde-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1019.24~20.04.1.1","5.15.0-1020.25~20.04.1.1","5.15.0-1021.26~20.04.1.1","5.15.0-1029.36~20.04.1.1","5.15.0-1030.37~20.04.1.1","5.15.0-1031.38~20.04.1.1","5.15.0-1033.40~20.04.1.1","5.15.0-1034.41~20.04.1.2","5.15.0-1035.42~20.04.1.1","5.15.0-1036.43~20.04.1.1","5.15.0-1037.44~20.04.1.1","5.15.0-1038.45~20.04.1.1","5.15.0-1039.46~20.04.1.1","5.15.0-1040.47~20.04.1.1","5.15.0-1041.48~20.04.1.1","5.15.0-1042.49~20.04.1.1","5.15.0-1043.50~20.04.1.1","5.15.0-1046.53~20.04.1.1","5.15.0-1047.54~20.04.1.1","5.15.0-1049.56~20.04.1.1","5.15.0-1050.57~20.04.1.1","5.15.0-1051.59~20.04.1.1","5.15.0-1052.60~20.04.1.1","5.15.0-1053.61~20.04.1.1","5.15.0-1054.62~20.04.1.1","5.15.0-1056.64~20.04.1.1","5.15.0-1057.65~20.04.1.1","5.15.0-1058.66~20.04.2.1","5.15.0-1059.67~20.04.1.1","5.15.0-1060.69~20.04.1.1","5.15.0-1061.70~20.04.1.1","5.15.0-1063.72~20.04.1.1","5.15.0-1064.73~20.04.1.1","5.15.0-1065.74~20.04.1.1","5.15.0-1067.76~20.04.1.1","5.15.0-1068.77~20.04.1.1","5.15.0-1070.79~20.04.1.1","5.15.0-1071.80~20.04.1.1","5.15.0-1072.81~20.04.1.1","5.15.0-1073.82~20.04.1.1","5.15.0-1074.83~20.04.1.1","5.15.0-1076.85~20.04.1.1","5.15.0-1078.87~20.04.1.1","5.15.0-1081.90~20.04.1.1","5.15.0-1082.91~20.04.1.1","5.15.0-1086.95~20.04.1.1","5.15.0-1087.96~20.04.1.1","5.15.0-1088.97~20.04.1.1","5.15.0-1089.98~20.04.1.1","5.15.0-1091.100~20.04.1.1","5.15.0-1094.103~20.04.1.1","5.15.0-1096.105~20.04.1.1","5.15.0-1097.106~20.04.1.1","5.15.0-1098.107~20.04.1.1","5.15.0-1102.111~20.04.1.1","5.15.0-1103.112~20.04.1.1","5.15.0-1111.120~20.04.1.1","5.15.0-1114.123~20.04.1","5.15.0-1116.125~20.04.1","5.15.0-1117.126~20.04.2","5.15.0-1118.127~20.04.1","5.15.0-1119.128~20.04.1","5.15.0-1120.129~20.04.1","5.15.0-1121.130~20.04.1","5.15.0-1122.131~20.04.1","5.15.0-1124.133~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-azure-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1008.8~24.04.1","6.11.0-1012.12~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1017.17~24.04.1","6.11.0-1018.18~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-gcp-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1006.6~24.04.2","6.11.0-1011.11~24.04.1","6.11.0-1013.13~24.04.1","6.11.0-1014.14~24.04.1","6.11.0-1015.15~24.04.1","6.11.0-1016.16~24.04.1","6.11.0-1017.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-17.17~24.04.2","6.11.0-19.19~24.04.1","6.11.0-21.21~24.04.1","6.11.0-24.24~24.04.1","6.11.0-25.25~24.04.1","6.11.0-26.26~24.04.1","6.11.0-28.28~24.04.1","6.11.0-29.29~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-lowlatency-hwe-6.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.0-1009.10~24.04.1","6.11.0-1011.12~24.04.1","6.11.0-1012.13~24.04.1","6.11.0-1013.14~24.04.1","6.11.0-1014.15~24.04.1","6.11.0-1015.16~24.04.2","6.11.0-1016.17~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-9.9.1","6.8.0-20.20.1","6.8.0-28.28.1","6.8.0-31.31.1","6.8.0-35.35.1","6.8.0-36.36.1","6.8.0-38.38.1","6.8.0-39.39.1","6.8.0-40.40.1","6.8.0-41.41.1","6.8.0-44.44.1","6.8.0-47.47.1","6.8.0-48.48.1","6.8.0-49.49.1","6.8.0-50.51.1","6.8.0-51.52.1","6.8.0-52.53.1","6.8.0-53.55.1","6.8.0-55.57.1","6.8.0-56.58.1","6.8.0-57.59.1","6.8.0-58.60.1","6.8.0-59.61.1","6.8.0-60.63.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-132.181"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121","3.13.0-79.123","3.13.0-83.127","3.13.0-85.129","3.13.0-86.130","3.13.0-86.131","3.13.0-87.133","3.13.0-88.135","3.13.0-91.138","3.13.0-92.139","3.13.0-93.140","3.13.0-95.142","3.13.0-96.143","3.13.0-98.145","3.13.0-100.147","3.13.0-101.148","3.13.0-103.150","3.13.0-105.152","3.13.0-106.153","3.13.0-107.154","3.13.0-108.155","3.13.0-109.156","3.13.0-110.157","3.13.0-111.158","3.13.0-112.159","3.13.0-113.160","3.13.0-115.162","3.13.0-116.163","3.13.0-117.164","3.13.0-119.166","3.13.0-121.170","3.13.0-123.172","3.13.0-125.174","3.13.0-126.175","3.13.0-128.177","3.13.0-129.178"],"bundled":18}],"products":[{"vendor":"google","product":"android"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.7.7","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"http://www.securitytracker.com/id/1037798","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://source.android.com/security/bulletin/2017-02-01.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/torvalds/linux/commit/22f6b4d34fcf039c63a94e7670e0da24f8575a5a","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=22f6b4d34fcf039c63a94e7670e0da24f8575a5a","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/96122","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10044"},{"url":"https://github.com/advisories/GHSA-mm9p-48xr-prf2"},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2025-1757693980.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2025-1757698145.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2025-1757967705.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-10044","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171247-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1003077","tags":["report"]},{"url":"https://bugzilla.suse.com/1015703","tags":["report"]},{"url":"https://bugzilla.suse.com/1021256","tags":["report"]},{"url":"https://bugzilla.suse.com/1021762","tags":["report"]},{"url":"https://bugzilla.suse.com/1023377","tags":["report"]},{"url":"https://bugzilla.suse.com/1023762","tags":["report"]},{"url":"https://bugzilla.suse.com/1023992","tags":["report"]},{"url":"https://bugzilla.suse.com/1024938","tags":["report"]},{"url":"https://bugzilla.suse.com/1025235","tags":["report"]},{"url":"https://bugzilla.suse.com/1026024","tags":["report"]},{"url":"https://bugzilla.suse.com/1026722","tags":["report"]},{"url":"https://bugzilla.suse.com/1026914","tags":["report"]},{"url":"https://bugzilla.suse.com/1027066","tags":["report"]},{"url":"https://bugzilla.suse.com/1027149","tags":["report"]},{"url":"https://bugzilla.suse.com/1027178","tags":["report"]},{"url":"https://bugzilla.suse.com/1027189","tags":["report"]},{"url":"https://bugzilla.suse.com/1027190","tags":["report"]},{"url":"https://bugzilla.suse.com/1028415","tags":["report"]},{"url":"https://bugzilla.suse.com/1028895","tags":["report"]},{"url":"https://bugzilla.suse.com/1029986","tags":["report"]},{"url":"https://bugzilla.suse.com/1030118","tags":["report"]},{"url":"https://bugzilla.suse.com/1030213","tags":["report"]},{"url":"https://bugzilla.suse.com/1030901","tags":["report"]},{"url":"https://bugzilla.suse.com/1031003","tags":["report"]},{"url":"https://bugzilla.suse.com/1031052","tags":["report"]},{"url":"https://bugzilla.suse.com/1031440","tags":["report"]},{"url":"https://bugzilla.suse.com/1031579","tags":["report"]},{"url":"https://bugzilla.suse.com/1032344","tags":["report"]},{"url":"https://bugzilla.suse.com/1033336","tags":["report"]},{"url":"https://bugzilla.suse.com/914939","tags":["report"]},{"url":"https://bugzilla.suse.com/954763","tags":["report"]},{"url":"https://bugzilla.suse.com/968697","tags":["report"]},{"url":"https://bugzilla.suse.com/979215","tags":["report"]},{"url":"https://bugzilla.suse.com/983212","tags":["report"]},{"url":"https://bugzilla.suse.com/989056","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7616","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171360-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1008842","tags":["report"]},{"url":"https://bugzilla.suse.com/1009682","tags":["report"]},{"url":"https://bugzilla.suse.com/1012620","tags":["report"]},{"url":"https://bugzilla.suse.com/1012985","tags":["report"]},{"url":"https://bugzilla.suse.com/1015787","tags":["report"]},{"url":"https://bugzilla.suse.com/1015821","tags":["report"]},{"url":"https://bugzilla.suse.com/1017512","tags":["report"]},{"url":"https://bugzilla.suse.com/1018100","tags":["report"]},{"url":"https://bugzilla.suse.com/1018263","tags":["report"]},{"url":"https://bugzilla.suse.com/1018419","tags":["report"]},{"url":"https://bugzilla.suse.com/1018446","tags":["report"]},{"url":"https://bugzilla.suse.com/1019168","tags":["report"]},{"url":"https://bugzilla.suse.com/1019514","tags":["report"]},{"url":"https://bugzilla.suse.com/1020048","tags":["report"]},{"url":"https://bugzilla.suse.com/1020795","tags":["report"]},{"url":"https://bugzilla.suse.com/1021374","tags":["report"]},{"url":"https://bugzilla.suse.com/1021913","tags":["report"]},{"url":"https://bugzilla.suse.com/1022559","tags":["report"]},{"url":"https://bugzilla.suse.com/1022971","tags":["report"]},{"url":"https://bugzilla.suse.com/1023164","tags":["report"]},{"url":"https://bugzilla.suse.com/1023207","tags":["report"]},{"url":"https://bugzilla.suse.com/1023824","tags":["report"]},{"url":"https://bugzilla.suse.com/1023888","tags":["report"]},{"url":"https://bugzilla.suse.com/1024081","tags":["report"]},{"url":"https://bugzilla.suse.com/1024234","tags":["report"]},{"url":"https://bugzilla.suse.com/1024309","tags":["report"]},{"url":"https://bugzilla.suse.com/1024508","tags":["report"]},{"url":"https://bugzilla.suse.com/1024788","tags":["report"]},{"url":"https://bugzilla.suse.com/1025039","tags":["report"]},{"url":"https://bugzilla.suse.com/1025354","tags":["report"]},{"url":"https://bugzilla.suse.com/1025802","tags":["report"]},{"url":"https://bugzilla.suse.com/1027974","tags":["report"]},{"url":"https://bugzilla.suse.com/1028041","tags":["report"]},{"url":"https://bugzilla.suse.com/1028595","tags":["report"]},{"url":"https://bugzilla.suse.com/1028648","tags":["report"]},{"url":"https://bugzilla.suse.com/1029470","tags":["report"]},{"url":"https://bugzilla.suse.com/1029850","tags":["report"]},{"url":"https://bugzilla.suse.com/1030593","tags":["report"]},{"url":"https://bugzilla.suse.com/1031080","tags":["report"]},{"url":"https://bugzilla.suse.com/1031567","tags":["report"]},{"url":"https://bugzilla.suse.com/1031662","tags":["report"]},{"url":"https://bugzilla.suse.com/1031842","tags":["report"]},{"url":"https://bugzilla.suse.com/1032125","tags":["report"]},{"url":"https://bugzilla.suse.com/1032141","tags":["report"]},{"url":"https://bugzilla.suse.com/1032345","tags":["report"]},{"url":"https://bugzilla.suse.com/1034670","tags":["report"]},{"url":"https://bugzilla.suse.com/103470","tags":["report"]},{"url":"https://bugzilla.suse.com/1034700","tags":["report"]},{"url":"https://bugzilla.suse.com/1035576","tags":["report"]},{"url":"https://bugzilla.suse.com/1035699","tags":["report"]},{"url":"https://bugzilla.suse.com/1035738","tags":["report"]},{"url":"https://bugzilla.suse.com/1035877","tags":["report"]},{"url":"https://bugzilla.suse.com/1036752","tags":["report"]},{"url":"https://bugzilla.suse.com/1038261","tags":["report"]},{"url":"https://bugzilla.suse.com/799133","tags":["report"]},{"url":"https://bugzilla.suse.com/857926","tags":["report"]},{"url":"https://bugzilla.suse.com/917630","tags":["report"]},{"url":"https://bugzilla.suse.com/922853","tags":["report"]},{"url":"https://bugzilla.suse.com/930399","tags":["report"]},{"url":"https://bugzilla.suse.com/931620","tags":["report"]},{"url":"https://bugzilla.suse.com/937444","tags":["report"]},{"url":"https://bugzilla.suse.com/940946","tags":["report"]},{"url":"https://bugzilla.suse.com/970083","tags":["report"]},{"url":"https://bugzilla.suse.com/971933","tags":["report"]},{"url":"https://bugzilla.suse.com/982783","tags":["report"]},{"url":"https://bugzilla.suse.com/984530","tags":["report"]},{"url":"https://bugzilla.suse.com/985561","tags":["report"]},{"url":"https://bugzilla.suse.com/988065","tags":["report"]},{"url":"https://bugzilla.suse.com/993832","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8106","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-10044","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3422-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3422-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10044","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7097","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-8650","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10200","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000251","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-10044","description":"The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.","status":"published","published":"2017-02-07T07:02:00Z","modified":"2024-10-21T13:14:17.686Z","updated_at":"2026-11-02T14:33:31.450804Z"}],"euvd":[{"id":"EUVD-2016-1239","description":"The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.","status":"published","published":"2017-02-07T07:02:00Z","modified":"2024-10-21T13:14:17Z","updated_at":"2026-11-03T00:27:32.038051Z"}],"ghsa":[{"id":"GHSA-mm9p-48xr-prf2","title":"The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict...","description":"The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.","status":"published","published":"2022-05-17T02:26:55Z","modified":"2023-02-02T05:03:51Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:51:44.264716Z"}],"nvd":[{"id":"CVE-2016-10044","description":"The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.","status":"published","published":"2017-02-07T07:59:00.293Z","modified":"2026-06-17T00:38:56.88Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:35.822579Z"}],"osv":[{"id":"CVE-2016-10044","description":"The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.","status":"published","published":"2017-02-07T07:59:00.293Z","modified":"2026-03-15T22:03:56.203057Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"DEBIAN-CVE-2016-10044","description":"The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.","status":"published","published":"2017-02-07T07:59:00.293Z","modified":"2026-09-22T07:01:07.628996661Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-10044","description":"The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.","status":"published","published":"2017-02-07T00:00:00Z","modified":"2026-10-28T08:17:20.288966212Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"CLSA-2025-1757693980","title":"kernel: Fix of 40 CVEs","description":"- x86/kvm: Disable kvmclock on all CPUs on shutdown {CVE-2021-47110}\n- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}\n- cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}\n- aio: mark AIO pseudo-fs noexec {CVE-2016-10044}\n- cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}\n- NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}\n- nfsd: register pernet ops last, unregister first {CVE-2025-38232}\n- do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}\n- net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}\n- net: atm: add lec_mutex {CVE-2025-38180}\n- SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}\n- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() {CVE-2025-38399}\n- scsi: target: Fix crash during SPEC_I_PT handling {CVE-2025-38399}\n- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}\n- drivers:md:fix a potential use-after-free bug {CVE-2022-50022}\n- ext4: avoid resizing to a partial cluster size {CVE-2022-50020}\n- HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}\n- net/sched: Abort __tc_modify_qdisc if parent class does not exist {CVE-2025-38457}\n- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788}\n- dlm: fix plock invalid read {CVE-2022-49407}\n- net: usb: smsc75xx: Limit packet length to skb-\u003elen {CVE-2023-53125}\n- scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}\n- crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}\n- HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}\n- HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}\n- ext4: Fix possible corruption when moving a directory {CVE-2023-53137}\n- ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}\n- vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}\n- HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}\n- sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}\n- ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}\n- ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50229}\n- dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}\n- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}\n- md-raid10: fix KASAN warning {CVE-2022-50211}\n- scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}\n- ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}\n- media: cxusb: no longer judge rbuf when the write fails {CVE-2025-38229}\n- ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}\n- ext4: fix off-by-one error in do_split {CVE-2025-23150}\n- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init {CVE-2025-37878}\n- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}\n- i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}","status":"published","published":"2025-09-12T16:19:44Z","modified":"2026-10-21T10:48:13.869634012Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1757698145","title":"kernel: Fix of 42 CVEs","description":"- x86/kvm: Disable kvmclock on all CPUs on shutdown {CVE-2021-47110}\n- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}\n- cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}\n- aio: mark AIO pseudo-fs noexec {CVE-2016-10044}\n- cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}\n- NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}\n- nfsd: register pernet ops last, unregister first {CVE-2025-38232}\n- net: atm: fix use after free in lec_send() {CVE-2025-22004}\n- net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}\n- do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}\n- net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}\n- net: atm: add lec_mutex {CVE-2025-38180}\n- SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}\n- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() {CVE-2025-38399}\n- scsi: target: Fix crash during SPEC_I_PT handling {CVE-2025-38399}\n- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}\n- drivers:md:fix a potential use-after-free bug {CVE-2022-50022}\n- ext4: avoid resizing to a partial cluster size {CVE-2022-50020}\n- HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}\n- net/sched: Abort __tc_modify_qdisc if parent class does not exist {CVE-2025-38457}\n- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788}\n- dlm: fix plock invalid read {CVE-2022-49407}\n- net: usb: smsc75xx: Limit packet length to skb-\u003elen {CVE-2023-53125}\n- scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}\n- crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}\n- HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}\n- HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}\n- ext4: Fix possible corruption when moving a directory {CVE-2023-53137}\n- ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}\n- vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}\n- HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}\n- sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}\n- ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}\n- ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50229}\n- dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}\n- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}\n- md-raid10: fix KASAN warning {CVE-2022-50211}\n- scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}\n- ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}\n- media: cxusb: no longer judge rbuf when the write fails {CVE-2025-38229}\n- ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}\n- ext4: fix off-by-one error in do_split {CVE-2025-23150}\n- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init {CVE-2025-37878}\n- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}\n- i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}","status":"published","published":"2025-09-12T17:29:09Z","modified":"2026-10-21T10:48:18.505728045Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1757967705","title":"kernel: Fix of 42 CVEs","description":"- x86/kvm: Disable kvmclock on all CPUs on shutdown {CVE-2021-47110}\n- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}\n- cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}\n- aio: mark AIO pseudo-fs noexec {CVE-2016-10044}\n- cifs: potential buffer overflow in handling symlinks {CVE-2022-49058}\n- NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}\n- nfsd: register pernet ops last, unregister first {CVE-2025-38232}\n- net: atm: fix use after free in lec_send() {CVE-2025-22004}\n- net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}\n- do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}\n- net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}\n- net: atm: add lec_mutex {CVE-2025-38180}\n- SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}\n- scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() {CVE-2025-38399}\n- scsi: target: Fix crash during SPEC_I_PT handling {CVE-2025-38399}\n- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}\n- drivers:md:fix a potential use-after-free bug {CVE-2022-50022}\n- ext4: avoid resizing to a partial cluster size {CVE-2022-50020}\n- HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}\n- net/sched: Abort __tc_modify_qdisc if parent class does not exist {CVE-2025-38457}\n- misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788}\n- dlm: fix plock invalid read {CVE-2022-49407}\n- net: usb: smsc75xx: Limit packet length to skb-\u003elen {CVE-2023-53125}\n- scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}\n- crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}\n- HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}\n- HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}\n- ext4: Fix possible corruption when moving a directory {CVE-2023-53137}\n- ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}\n- vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}\n- HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}\n- sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}\n- ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}\n- ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50229}\n- dm ioctl: prevent potential spectre v1 gadget {CVE-2022-49122}\n- net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}\n- md-raid10: fix KASAN warning {CVE-2022-50211}\n- scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}\n- ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}\n- media: cxusb: no longer judge rbuf when the write fails {CVE-2025-38229}\n- ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}\n- ext4: fix off-by-one error in do_split {CVE-2025-23150}\n- perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init {CVE-2025-37878}\n- sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}\n- i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}","status":"published","published":"2025-09-15T20:21:49Z","modified":"2026-10-21T10:47:55.525588118Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"SUSE-SU-2017:1247-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2015-1350: The VFS subsystem in the Linux kernel provided an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allowed local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program (bnc#914939).\n- CVE-2016-2117: The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly enabled scatter/gather I/O, which allowed remote attackers to obtain sensitive information from kernel memory by reading packet data (bnc#968697).\n- CVE-2016-3070: The trace_writeback_dirty_page implementation in include/trace/events/writeback.h in the Linux kernel improperly interacted with mm/migrate.c, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move (bnc#979215).\n- CVE-2016-5243: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel did not properly copy a certain string, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#983212).\n- CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing (bnc#1003077).\n- CVE-2016-9588: arch/x86/kvm/vmx.c in the Linux kernel mismanages the #BP and #OF exceptions, which allowed guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by an L2 guest (bnc#1015703).\n- CVE-2016-10044: The aio_mount function in fs/aio.c in the Linux kernel did not properly restrict execute access, which made it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call (bnc#1023992).\n- CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415).\n- CVE-2016-10208: The ext4_fill_super function in fs/ext4/super.c in the Linux kernel did not properly validate meta block groups, which allowed physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image (bnc#1023377).\n- CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003).\n- CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914).\n- CVE-2017-5897: The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allowed remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access (bnc#1023762).\n- CVE-2017-5970: The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel allowed attackers to cause a denial of service (system crash) via (1) an application that made crafted system calls or possibly (2) IPv4 traffic with invalid IP options (bnc#1024938).\n- CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bnc#1025235).\n- CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024).\n- CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722).\n- CVE-2017-6345: The LLC subsystem in the Linux kernel did not ensure that a certain destructor exists in required circumstances, which allowed local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls (bnc#1027190).\n- CVE-2017-6346: Race condition in net/packet/af_packet.c in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that made PACKET_FANOUT setsockopt system calls (bnc#1027189).\n- CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel improperly managed lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178).\n- CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986 (bnc#1027066).\n- CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213).\n- CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052).\n- CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440).\n- CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579).\n- CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation (bnc#1033336).\n\nThe following non-security bugs were fixed:\n\n- ext4: fix fencepost in s_first_meta_bg validation (bsc#1029986).\n- hwrng: virtio - ensure reads happen after successful probe (bsc#954763 bsc#1032344).\n- kgr/module: make a taint flag module-specific (fate#313296).\n- l2tp: fix address test in __l2tp_ip6_bind_lookup() (bsc#1028415).\n- l2tp: fix lookup for sockets not bound to a device in l2tp_ip (bsc#1028415).\n- l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind() (bsc#1028415).\n- l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv() (bsc#1028415).\n- l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6 (bsc#1028415).\n- l2tp: lock socket before checking flags in connect() (bsc#1028415).\n- mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp (bnc#1030118).\n- module: move add_taint_module() to a header file (fate#313296).\n- netfilter: bridge: Fix the build when IPV6 is disabled (bsc#1027149).\n- nfs: flush out dirty data on file fput() (bsc#1021762).\n- powerpc: Blacklist GCC 5.4 6.1 and 6.2 (boo#1028895).\n- powerpc: Reject binutils 2.24 when building little endian (boo#1028895).\n- revert 'procfs: mark thread stack correctly in proc/\u003cpid\u003e/maps' (bnc#1030901).\n- taint/module: Clean up global and module taint flags handling (fate#313296).\n- usb: serial: kl5kusb105: fix line-state error handling (bsc#1021256).\n- xfs_dmapi: fix the debug compilation of xfs_dmapi (bsc#989056).\n- xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).\n","status":"published","published":"2017-05-11T14:24:14Z","modified":"2026-02-04T04:27:50.154633Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1360-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.74 to receive various security and bugfixes.\n\nNotable new/improved features:\n- Improved support for Hyper-V\n- Support for the tcp_westwood TCP scheduling algorithm\n\nThe following security bugs were fixed:\n\n- CVE-2017-8106: The handle_invept function in arch/x86/kvm/vmx.c in the Linux kernel allowed privileged KVM guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a single-context INVEPT instruction with a NULL EPT pointer (bsc#1035877).\n- CVE-2017-6951: The keyring_search_aux function in security/keys/keyring.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the 'dead' type. (bsc#1029850).\n- CVE-2017-2647: The KEYS subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain match field, related to the keyring_search_iterator function in keyring.c. (bsc#1030593)\n- CVE-2016-9604: This fixes handling of keyrings starting with '.' in KEYCTL_JOIN_SESSION_KEYRING, which could have allowed local users to manipulate privileged keyrings (bsc#1035576)\n- CVE-2017-7616: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allowed local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation. (bnc#1033336).\n- CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. (bsc#1034670).\n- CVE-2017-7308: The packet_set_ring function in net/packet/af_packet.c in the Linux kernel did not properly validate certain block-size data, which allowed local users to cause a denial of service (overflow) or possibly have unspecified other impact via crafted system calls (bnc#1031579)\n- CVE-2017-2671: The ping_unhash function in net/ipv4/ping.c in the Linux kernel was  too late in obtaining a certain lock and consequently could not ensure that disconnect function calls are safe, which allowed local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call (bnc#1031003)\n- CVE-2017-7294: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not validate addition of certain levels data, which allowed local users to trigger an integer overflow and out-of-bounds write, and cause a denial of service (system hang or crash) or possibly gain privileges, via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031440)\n- CVE-2017-7261: The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel did not check for a zero value of certain levels data, which allowed local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device (bnc#1031052)\n- CVE-2017-7187: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function (bnc#1030213)\n- CVE-2016-9588: arch/x86/kvm/vmx.c in the Linux kernel mismanaged the #BP and #OF exceptions, which allowed guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by an L2 guest (bsc#1015703).\n- CVE-2017-5669: The do_shmat function in ipc/shm.c in the Linux kernel did not restrict the address calculated by a certain rounding operation, which allowed local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context (bnc#1026914).\n- CVE-2016-10200: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c (bnc#1028415)\n- CVE-2016-10208: The ext4_fill_super function in fs/ext4/super.c in the Linux kernel did not properly validate meta block groups, which allowed physically proximate attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image (bnc#1023377).\n- CVE-2017-5897: The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allowed remote attackers to have unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds access (bsc#1023762).\n- CVE-2017-5986: A race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bsc#1025235).\n- CVE-2017-6074: The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel mishandled DCCP_PKT_REQUEST packet data structures in the LISTEN state, which allowed local users to obtain root privileges or cause a denial of service (double free) via an application that made an IPV6_RECVPKTINFO setsockopt system call (bnc#1026024)\n- CVE-2016-9191: The cgroup offline implementation in the Linux kernel mishandled certain drain operations, which allowed local users to cause a denial of service (system hang) by leveraging access to a container environment for executing a crafted application (bnc#1008842)\n- CVE-2017-6348: The hashbin_delete function in net/irda/irqueue.c in the Linux kernel improperly managed lock dropping, which allowed local users to cause a denial of service (deadlock) via crafted operations on IrDA devices (bnc#1027178).\n- CVE-2016-10044: The aio_mount function in fs/aio.c in the Linux kernel did not properly restrict execute access, which made it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call (bnc#1023992).\n- CVE-2016-3070: The trace_writeback_dirty_page implementation in include/trace/events/writeback.h in the Linux kernel improperly interacts with mm/migrate.c, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move (bnc#979215).\n- CVE-2016-5243: The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel did not properly copy a certain string, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#983212).\n- CVE-2017-6345: The LLC subsystem in the Linux kernel did not ensure that a certain destructor exists in required circumstances, which allowed local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls (bnc#1027190)\n- CVE-2017-6346: Race condition in net/packet/af_packet.c in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that made PACKET_FANOUT setsockopt system calls (bnc#1027189)\n- CVE-2017-6353: net/sctp/socket.c in the Linux kernel did not properly restrict association peel-off operations during certain wait states, which allowed local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986 (bnc#1027066)\n- CVE-2017-5986: Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel allowed local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state (bsc#1025235).\n- CVE-2017-6214: The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel allowed remote attackers to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the URG flag (bnc#1026722)\n- CVE-2016-2117: The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel incorrectly enables scatter/gather I/O, which allowed remote attackers to obtain sensitive information from kernel memory by reading packet data (bnc#968697)\n- CVE-2015-1350: The VFS subsystem in the Linux kernel provided an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allowed local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program (bsc#914939).\n- CVE-2016-7117: Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel allowed remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing (bsc#1003077).\n\nThe following non-security bugs were fixed:\n\n- ACPI / APEI: Fix NMI notification handling (bsc#917630).\n- arch: Mass conversion of smp_mb__*() (bsc#1020795).\n- asm-generic: add __smp_xxx wrappers (bsc#1020795).\n- block: remove struct request buffer member (bsc#1020795).\n- block: submit_bio_wait() conversions (bsc#1020795).\n- bonding: Advertize vxlan offload features when supported (bsc#1009682).\n- bonding: handle more gso types (bsc#1009682).\n- bonding: use the correct ether type for alb (bsc#1028595).\n- btrfs: allow unlink to exceed subvolume quota (bsc#1015821).\n- btrfs: Change qgroup_meta_rsv to 64bit (bsc#1015821).\n- btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls (bsc#1018100).\n- btrfs: make file clone aware of fatal signals (bsc#1015787).\n- btrfs: qgroups: Retry after commit on getting EDQUOT (bsc#1015821).\n- cancel the setfilesize transation when io error happen (bsc#1028648).\n- cgroup: remove stray references to css_id (bsc#1020795).\n- cpuidle: powernv/pseries: Auto-promotion of snooze to deeper idle state (bnc#1023164).\n- dm: add era target (bsc#1020795).\n- dm: allow remove to be deferred (bsc#1020795).\n- dm bitset: only flush the current word if it has been dirtied (bsc#1020795).\n- dm btree: add dm_btree_find_lowest_key (bsc#1020795).\n- dm cache: actually resize cache (bsc#1020795).\n- dm cache: add block sizes and total cache blocks to status output (bsc#1020795).\n- dm cache: add cache block invalidation support (bsc#1020795).\n- dm cache: add passthrough mode (bsc#1020795).\n- dm cache: add policy name to status output (bsc#1020795).\n- dm cache: add remove_cblock method to policy interface (bsc#1020795).\n- dm cache: be much more aggressive about promoting writes to discarded blocks (bsc#1020795).\n- dm cache: cache shrinking support (bsc#1020795).\n- dm cache: do not add migration to completed list before unhooking bio (bsc#1020795).\n- dm cache: fix a lock-inversion (bsc#1020795).\n- dm cache: fix truncation bug when mapping I/O to more than 2TB fast device (bsc#1020795).\n- dm cache: fix writethrough mode quiescing in cache_map (bsc#1020795).\n- dm cache: improve efficiency of quiescing flag management (bsc#1020795).\n- dm cache: io destined for the cache device can now serve as tick bios (bsc#1020795).\n- dm cache: log error message if dm_kcopyd_copy() fails (bsc#1020795).\n- dm cache metadata: check the metadata version when reading the superblock (bsc#1020795).\n- dm cache metadata: return bool from __superblock_all_zeroes (bsc#1020795).\n- dm cache: move hook_info into common portion of per_bio_data structure (bsc#1020795).\n- dm cache: optimize commit_if_needed (bsc#1020795).\n- dm cache policy mq: a few small fixes (bsc#1020795).\n- dm cache policy mq: fix promotions to occur as expected (bsc#1020795).\n- dm cache policy mq: implement writeback_work() and mq_{set,clear}_dirty() (bsc#1020795).\n- dm cache policy mq: introduce three promotion threshold tunables (bsc#1020795).\n- dm cache policy mq: protect residency method with existing mutex (bsc#1020795).\n- dm cache policy mq: reduce memory requirements (bsc#1020795).\n- dm cache policy mq: use list_del_init instead of list_del + INIT_LIST_HEAD (bsc#1020795).\n- dm cache policy: remove return from void policy_remove_mapping (bsc#1020795).\n- dm cache: promotion optimisation for writes (bsc#1020795).\n- dm cache: resolve small nits and improve Documentation (bsc#1020795).\n- dm cache: return -EINVAL if the user specifies unknown cache policy (bsc#1020795).\n- dm cache: use cell_defer() boolean argument consistently (bsc#1020795).\n- dm: change sector_count member in clone_info from sector_t to unsigned (bsc#1020795).\n- dm crypt: add TCW IV mode for old CBC TCRYPT containers (bsc#1020795).\n- dm crypt: properly handle extra key string in initialization (bsc#1020795).\n- dm delay: use per-bio data instead of a mempool and slab cache (bsc#1020795).\n- dm: fix Kconfig indentation (bsc#1020795).\n- dm: fix Kconfig menu indentation (bsc#1020795).\n- dm: make dm_table_alloc_md_mempools static (bsc#1020795).\n- dm mpath: do not call pg_init when it is already running (bsc#1020795).\n- dm mpath: fix lock order inconsistency in multipath_ioctl (bsc#1020795).\n- dm mpath: print more useful warnings in multipath_message() (bsc#1020795).\n- dm mpath: push back requests instead of queueing (bsc#1020795).\n- dm mpath: really fix lockdep warning (bsc#1020795).\n- dm mpath: reduce memory pressure when requeuing (bsc#1020795).\n- dm mpath: remove extra nesting in map function (bsc#1020795).\n- dm mpath: remove map_io() (bsc#1020795).\n- dm mpath: remove process_queued_ios() (bsc#1020795).\n- dm mpath: requeue I/O during pg_init (bsc#1020795).\n- dm persistent data: cleanup dm-thin specific references in text (bsc#1020795).\n- dm snapshot: call destroy_work_on_stack() to pair with INIT_WORK_ONSTACK() (bsc#1020795).\n- dm snapshot: fix metadata corruption (bsc#1020795).\n- dm snapshot: prepare for switch to using dm-bufio (bsc#1020795).\n- dm snapshot: use dm-bufio (bsc#1020795).\n- dm snapshot: use dm-bufio prefetch (bsc#1020795).\n- dm snapshot: use GFP_KERNEL when initializing exceptions (bsc#1020795).\n- dm space map disk: optimise sm_disk_dec_block (bsc#1020795).\n- dm space map metadata: limit errors in sm_metadata_new_block (bsc#1020795).\n- dm: stop using bi_private (bsc#1020795).\n- dm table: add dm_table_run_md_queue_async (bsc#1020795).\n- dm table: print error on preresume failure (bsc#1020795).\n- dm table: remove unused buggy code that extends the targets array (bsc#1020795).\n- dm thin: add error_if_no_space feature (bsc#1020795).\n- dm thin: add mappings to end of prepared_* lists (bsc#1020795).\n- dm thin: add 'no_space_timeout' dm-thin-pool module param (bsc#1020795).\n- dm thin: add timeout to stop out-of-data-space mode holding IO forever (bsc#1020795).\n- dm thin: allow metadata commit if pool is in PM_OUT_OF_DATA_SPACE mode (bsc#1020795).\n- dm thin: allow metadata space larger than supported to go unused (bsc#1020795).\n- dm thin: cleanup and improve no space handling (bsc#1020795).\n- dm thin: eliminate the no_free_space flag (bsc#1020795).\n- dm thin: ensure user takes action to validate data and metadata consistency (bsc#1020795).\n- dm thin: factor out check_low_water_mark and use bools (bsc#1020795).\n- dm thin: fix deadlock in __requeue_bio_list (bsc#1020795).\n- dm thin: fix noflush suspend IO queueing (bsc#1020795).\n- dm thin: fix out of data space handling (bsc#1020795).\n- dm thin: fix pool feature parsing (bsc#1020795).\n- dm thin: fix rcu_read_lock being held in code that can sleep (bsc#1020795).\n- dm thin: handle metadata failures more consistently (bsc#1020795).\n- dm thin: irqsave must always be used with the pool-\u003elock spinlock (bsc#1020795).\n- dm thin: log info when growing the data or metadata device (bsc#1020795).\n- dm thin: requeue bios to DM core if no_free_space and in read-only mode (bsc#1020795).\n- dm thin: return error from alloc_data_block if pool is not in write mode (bsc#1020795).\n- dm thin: simplify pool_is_congested (bsc#1020795).\n- dm thin: sort the per thin deferred bios using an rb_tree (bsc#1020795).\n- dm thin: synchronize the pool mode during suspend (bsc#1020795).\n- dm thin: use bool rather than unsigned for flags in structures (bsc#1020795).\n- dm thin: use INIT_WORK_ONSTACK in noflush_work to avoid ODEBUG warning (bsc#1020795).\n- dm thin: use per thin device deferred bio lists (bsc#1020795).\n- dm: use RCU_INIT_POINTER instead of rcu_assign_pointer in __unbind (bsc#1020795).\n- drm/i915: relax uncritical udelay_range() (bsc#1038261).\n- ether: add loopback type ETH_P_LOOPBACK (bsc#1028595).\n- ext4: fix bh leak on error paths in ext4_rename() and ext4_cross_rename() (bsc#1012985).\n- ext4: fix fencepost in s_first_meta_bg validation (bsc#1029986).\n- ext4: mark inode dirty after converting inline directory (bsc#1012985).\n- ftrace: Make ftrace_location_range() global (FATE#322421).\n- HID: usbhid: improve handling of Clear-Halt and reset (bsc#1031080).\n- hv: util: catch allocation errors\n- hv: utils: use memdup_user in hvt_op_write\n- hwrng: virtio - ensure reads happen after successful probe (bsc#954763 bsc#1032344).\n- i40e: avoid null pointer dereference (bsc#922853).\n- i40e/i40evf: Break up xmit_descriptor_count from maybe_stop_tx (bsc#985561).\n- i40e/i40evf: Limit TSO to 7 descriptors for payload instead of 8 per packet (bsc#985561).\n- i40e/i40evf: Rewrite logic for 8 descriptor per packet check (bsc#985561).\n- i40e: Impose a lower limit on gso size (bsc#985561).\n- i40e: Limit TX descriptor count in cases where frag size is greater than 16K (bsc#985561).\n- iommu/vt-d: Flush old iommu caches for kdump when the device gets context mapped (bsc#1023824).\n- iommu/vt-d: Tylersburg isoch identity map check is done too late (bsc#1032125).\n- ipv6: make ECMP route replacement less greedy (bsc#930399).\n- kabi: hide changes in struct sk_buff (bsc#1009682).\n- KABI: Hide new include in arch/powerpc/kernel/process.c (fate#322421).\n- kABI: mask struct xfs_icdinode change (bsc#1024788).\n- kABI: protect struct inet6_dev (kabi).\n- kABI: protect struct iscsi_conn (bsc#103470).\n- kABI: protect struct xfs_buftarg and struct xfs_mount (bsc#1024508).\n- kABI: restore can_rx_register parameters (kabi).\n- kernel/watchdog: use nmi registers snapshot in hardlockup handler (bsc#940946, bsc#937444).\n- kgr: Mark eeh_event_handler() kthread safe using a timeout (bsc#1031662).\n- kgr/module: make a taint flag module-specific\n- kgr: remove unneeded kgr_needs_lazy_migration() s390x definition\n- l2tp: fix address test in __l2tp_ip6_bind_lookup() (bsc#1028415).\n- l2tp: fix lookup for sockets not bound to a device in l2tp_ip (bsc#1028415).\n- l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind() (bsc#1028415).\n- l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv() (bsc#1028415).\n- l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6 (bsc#1028415).\n- l2tp: lock socket before checking flags in connect() (bsc#1028415).\n- livepatch: Allow architectures to specify an alternate ftrace location (FATE#322421).\n- locking/semaphore: Add down_interruptible_timeout() (bsc#1031662).\n- md: avoid oops on unload if some process is in poll or select (bsc#1020795).\n- md: Convert use of typedef ctl_table to struct ctl_table (bsc#1020795).\n- md: ensure metadata is writen after raid level change (bsc#1020795).\n- md linear: fix a race between linear_add() and linear_congested() (bsc#1018446).\n- md: md_clear_badblocks should return an error code on failure (bsc#1020795).\n- md: refuse to change shape of array if it is active but read-only (bsc#1020795).\n- megaraid_sas: add missing curly braces in ioctl handler (bsc#1023207).\n- megaraid_sas: Fixup tgtid count in megasas_ld_list_query() (bsc#971933).\n- mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp (bnc#1030118).\n- mm, memcg: do not retry precharge charges (bnc#1022559).\n- mm/mempolicy.c: do not put mempolicy before using its nodemask (References: VM Performance, bnc#931620).\n- mm/page_alloc: fix nodes for reclaim in fast path (bnc#1031842).\n- module: move add_taint_module() to a header file\n- net: Add skb_gro_postpull_rcsum to udp and vxlan (bsc#1009682).\n- net: add skb_pop_rcv_encapsulation (bsc#1009682).\n- net: Call skb_checksum_init in IPv4 (bsc#1009682).\n- net: Call skb_checksum_init in IPv6 (bsc#1009682).\n- netfilter: allow logging fron non-init netns (bsc#970083).\n- net: Generalize checksum_init functions (bsc#1009682).\n- net: Preserve CHECKSUM_COMPLETE at validation (bsc#1009682).\n- NFS: do not try to cross a mountpount when there isn't one there (bsc#1028041).\n- NFS: Expedite unmount of NFS auto-mounts (bnc#1025802).\n- NFS: Fix a performance regression in readdir (bsc#857926).\n- NFS: flush out dirty data on file fput() (bsc#1021762).\n- ocfs2: do not write error flag to user structure we cannot copy from/to (bsc#1012985).\n- powerpc: Blacklist GCC 5.4 6.1 and 6.2 (boo#1028895).\n- powerpc: Create a helper for getting the kernel toc value (FATE#322421).\n- powerpc/fadump: Fix the race in crash_fadump() (bsc#1022971).\n- powerpc/fadump: Reserve memory at an offset closer to bottom of RAM (bsc#1032141).\n- powerpc/fadump: Update fadump documentation (bsc#1032141).\n- powerpc/ftrace: Add Kconfig \u0026 Make glue for mprofile-kernel (FATE#322421).\n- powerpc/ftrace: Add support for -mprofile-kernel ftrace ABI (FATE#322421).\n- powerpc/ftrace: Use $(CC_FLAGS_FTRACE) when disabling ftrace (FATE#322421).\n- powerpc/ftrace: Use generic ftrace_modify_all_code() (FATE#322421).\n- powerpc: introduce TIF_KGR_IN_PROGRESS thread flag (FATE#322421).\n- powerpc/kgraft: Add kgraft header (FATE#322421).\n- powerpc/kgraft: Add kgraft stack to struct thread_info (FATE#322421).\n- powerpc/kgraft: Add live patching support on ppc64le (FATE#322421).\n- powerpc/module: Create a special stub for ftrace_caller() (FATE#322421).\n- powerpc/module: Mark module stubs with a magic value (FATE#322421).\n- powerpc/module: Only try to generate the ftrace_caller() stub once (FATE#322421).\n- powerpc/modules: Never restore r2 for a mprofile-kernel style mcount() call (FATE#322421).\n- powerpc/prom: Increase minimum RMA size to 512MB (bsc#984530).\n- powerpc/pseries/cpuidle: Remove MAX_IDLE_STATE macro (bnc#1023164).\n- powerpc/pseries/cpuidle: Use cpuidle_register() for initialisation (bnc#1023164).\n- powerpc: Reject binutils 2.24 when building little endian (boo#1028895).\n- RAID1: avoid unnecessary spin locks in I/O barrier code (bsc#982783,bsc#1020048).\n- raid1: include bio_end_io_list in nr_queued to prevent freeze_array hang\n- remove mpath patches from dmcache backport, for bsc#1035738\n- revert 'procfs: mark thread stack correctly in proc/PID/maps' (bnc#1030901).\n- Revert 'RDMA/core: Fix incorrect structure packing for booleans' (kabi).\n- rtnetlink: allow to register ops without ops-\u003esetup set (bsc#1021374).\n- s390/zcrypt: Introduce CEX6 toleration (FATE#321783, LTC#147506, bsc#1019514).\n- sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting (bsc#1018419).\n- scsi_error: count medium access timeout only once per EH run (bsc#993832, bsc#1032345).\n- scsi: libiscsi: add lock around task lists to fix list corruption regression (bsc#1034700).\n- scsi: storvsc: fix SRB_STATUS_ABORTED handling\n- sfc: reduce severity of PIO buffer alloc failures (bsc#1019168).\n- svcrpc: fix gss-proxy NULL dereference in some error cases (bsc#1024309).\n- taint/module: Clean up global and module taint flags handling\n- tcp: abort orphan sockets stalling on zero window probes (bsc#1021913).\n- thp: fix MADV_DONTNEED vs. numa balancing race (bnc#1027974).\n- thp: reduce indentation level in change_huge_pmd() (bnc#1027974).\n- treewide: fix 'distingush' typo (bsc#1020795).\n- tree-wide: use reinit_completion instead of INIT_COMPLETION (bsc#1020795).\n- usb: dwc3: gadget: Fix incorrect DEPCMD and DGCMD status macros (bsc#1035699).\n- usb: host: xhci: print correct command ring address (bnc#1035699).\n- USB: serial: kl5kusb105: fix line-state error handling (bsc#1021256).\n- vfs: Do not exchange 'short' filenames unconditionally (bsc#1012985).\n- vfs: split generic splice code from i_mutex locking (bsc#1024788).\n- vmxnet3: segCnt can be 1 for LRO packets (bsc#988065).\n- VSOCK: Detach QP check should filter out non matching QPs (bsc#1036752).\n- vxlan: cancel sock_work in vxlan_dellink() (bsc#1031567).\n- vxlan: Checksum fixes (bsc#1009682).\n- vxlan: GRO support at tunnel layer (bsc#1009682).\n- xen-blkfront: correct maximum segment accounting (bsc#1018263).\n- xen-blkfront: do not call talk_to_blkback when already connected to blkback.\n- xen-blkfront: free resources if xlvbd_alloc_gendisk fails.\n- xfs_dmapi: fix the debug compilation of xfs_dmapi (bsc#989056).\n- xfs: do not allow di_size with high bit set (bsc#1024234).\n- xfs: do not assert fail on non-async buffers on ioacct decrement (bsc#1024508).\n- xfs: exclude never-released buffers from buftarg I/O accounting (bsc#1024508).\n- xfs: fix broken multi-fsb buffer logging (bsc#1024081).\n- xfs: fix buffer overflow dm_get_dirattrs/dm_get_dirattrs2 (bsc#989056).\n- xfs: Fix lock ordering in splice write (bsc#1024788).\n- xfs: fix up xfs_swap_extent_forks inline extent handling (bsc#1023888).\n- xfs: Make xfs_icdinode-\u003edi_dmstate atomic_t (bsc#1024788).\n- xfs: pass total block res. as total xfs_bmapi_write() parameter (bsc#1029470).\n- xfs: replace global xfslogd wq with per-mount wq (bsc#1024508).\n- xfs: track and serialize in-flight async buffers against unmount (bsc#1024508).\n","status":"published","published":"2017-05-19T12:12:38Z","modified":"2026-02-04T03:19:59.910788Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3422-1","title":"linux vulnerabilities","description":"It was discovered that a buffer overflow existed in the Bluetooth stack of\nthe Linux kernel when handling L2CAP configuration responses. A physically\nproximate attacker could use this to cause a denial of service (system\ncrash). (CVE-2017-1000251)\n\nIt was discovered that the asynchronous I/O (aio) subsystem of the Linux\nkernel did not properly set permissions on aio memory mappings in some\nsituations. An attacker could use this to more easily exploit other\nvulnerabilities. (CVE-2016-10044)\n\nBaozeng Ding and Andrey Konovalov discovered a race condition in the L2TPv3\nIP Encapsulation implementation in the Linux kernel. A local attacker could\nuse this to cause a denial of service (system crash) or possibly execute\narbitrary code. (CVE-2016-10200)\n\nAndreas Gruenbacher and Jan Kara discovered that the filesystem\nimplementation in the Linux kernel did not clear the setgid bit during a\nsetxattr call. A local attacker could use this to possibly elevate group\nprivileges. (CVE-2016-7097)\n\nSergej Schumilo, Ralf Spenneberg, and Hendrik Schwartke discovered that the\nkey management subsystem in the Linux kernel did not properly allocate\nmemory in some situations. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2016-8650)\n\nVlad Tsyrklevich discovered an integer overflow vulnerability in the VFIO\nPCI driver for the Linux kernel. A local attacker with access to a vfio PCI\ndevice file could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2016-9083, CVE-2016-9084)\n\nIt was discovered that an information leak existed in __get_user_asm_ex()\nin the Linux kernel. A local attacker could use this to expose sensitive\ninformation. (CVE-2016-9178)\n\nCAI Qian discovered that the sysctl implementation in the Linux kernel did\nnot properly perform reference counting in some situations. An unprivileged\nattacker could use this to cause a denial of service (system hang).\n(CVE-2016-9191)\n\nIt was discovered that the keyring implementation in the Linux kernel in\nsome situations did not prevent special internal keyrings from being joined\nby userspace keyrings. A privileged local attacker could use this to bypass\nmodule verification. (CVE-2016-9604)\n\nIt was discovered that an integer overflow existed in the trace subsystem\nof the Linux kernel. A local privileged attacker could use this to cause a\ndenial of service (system crash). (CVE-2016-9754)\n\nAndrey Konovalov discovered that the IPv4 implementation in the Linux\nkernel did not properly handle invalid IP options in some situations. An\nattacker could use this to cause a denial of service or possibly execute\narbitrary code. (CVE-2017-5970)\n\nDmitry Vyukov discovered that the Linux kernel did not properly handle TCP\npackets with the URG flag. A remote attacker could use this to cause a\ndenial of service. (CVE-2017-6214)\n\nIt was discovered that a race condition existed in the AF_PACKET handling\ncode in the Linux kernel. A local attacker could use this to cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2017-6346)\n\nIt was discovered that the keyring implementation in the Linux kernel did\nnot properly restrict searches for dead keys. A local attacker could use\nthis to cause a denial of service (system crash). (CVE-2017-6951)\n\nDmitry Vyukov discovered that the generic SCSI (sg) subsystem in the Linux\nkernel contained a stack-based buffer overflow. A local attacker with\naccess to an sg device could use this to cause a denial of service (system\ncrash) or possibly execute arbitrary code. (CVE-2017-7187)\n\nEric Biggers discovered a memory leak in the keyring implementation in the\nLinux kernel. A local attacker could use this to cause a denial of service\n(memory consumption). (CVE-2017-7472)\n\nIt was discovered that a buffer overflow existed in the Broadcom FullMAC\nWLAN driver in the Linux kernel. A local attacker could use this to cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-7541)\n","status":"published","published":"2017-09-18T20:29:06Z","modified":"2026-04-22T09:39:30.53389Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}