{"id":"CVE-2016-1576","aliases":["DEBIAN-CVE-2016-1576","EUVD-2016-2671","GHSA-6774-jh98-f2hq","UBUNTU-CVE-2016-1576","USN-2907-1","USN-2908-2","USN-2909-1","USN-2910-1"],"status":"published","title":"The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the...","description":"The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01129,"percentile":0.66576,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2016-02-22T00:00:00Z","modified":"2026-09-22T07:01:25Z","exploits":[{"source":"exploitdb","id":"EDB-41763","title":"Ubuntu 15.10 - 'USERNS ' Overlayfs Over Fuse Privilege Escalation","type":"local","platform":"linux","date":"2016-11-22","url":"https://www.exploit-db.com/exploits/41763"}],"fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.5.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-79.123"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","fixed_in":["3.16.0-62.82~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","fixed_in":["3.19.0-51.57~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-wily","fixed_in":["4.2.0-30.35~14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-79.123"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-62.82~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1","3.16.0-33.44~14.04.1","3.16.0-34.45~14.04.1","3.16.0-34.47~14.04.1","3.16.0-36.48~14.04.1","3.16.0-37.49~14.04.1","3.16.0-37.51~14.04.1","3.16.0-38.52~14.04.1","3.16.0-39.53~14.04.1","3.16.0-40.54~14.04.1","3.16.0-41.55~14.04.1","3.16.0-41.57~14.04.1","3.16.0-43.58~14.04.1","3.16.0-44.59~14.04.1","3.16.0-45.60~14.04.1","3.16.0-46.62~14.04.1","3.16.0-48.64~14.04.1","3.16.0-49.65~14.04.1","3.16.0-50.66~14.04.1","3.16.0-50.67~14.04.1","3.16.0-51.69~14.04.1","3.16.0-52.71~14.04.1","3.16.0-53.72~14.04.1","3.16.0-55.74~14.04.1","3.16.0-56.75~14.04.1","3.16.0-57.77~14.04.1","3.16.0-59.79~14.04.1","3.16.0-60.80~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-51.57~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1","3.19.0-20.20~14.04.1","3.19.0-21.21~14.04.1","3.19.0-22.22~14.04.1","3.19.0-23.24~14.04.1","3.19.0-25.26~14.04.1","3.19.0-26.28~14.04.1","3.19.0-28.30~14.04.1","3.19.0-30.33~14.04.1","3.19.0-30.34~14.04.1","3.19.0-31.36~14.04.1","3.19.0-32.37~14.04.1","3.19.0-33.38~14.04.1","3.19.0-37.42~14.04.1","3.19.0-39.44~14.04.1","3.19.0-41.46~14.04.2","3.19.0-42.48~14.04.1","3.19.0-43.49~14.04.1","3.19.0-47.53~14.04.1","3.19.0-49.55~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-wily","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-30.35~14.04.1"}]}],"versions":["4.2.0-18.22~14.04.1","4.2.0-19.23~14.04.1","4.2.0-21.25~14.04.1","4.2.0-22.27~14.04.1","4.2.0-23.28~14.04.1","4.2.0-25.30~14.04.1","4.2.0-27.32~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-79.123"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-wily","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-30.35~14.04.1"}]}],"versions":["4.2.0-18.22~14.04.1","4.2.0-19.23~14.04.1","4.2.0-21.25~14.04.1","4.2.0-22.27~14.04.1","4.2.0-23.28~14.04.1","4.2.0-25.30~14.04.1","4.2.0-27.32~14.04.1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-62.82~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1","3.16.0-33.44~14.04.1","3.16.0-34.45~14.04.1","3.16.0-34.47~14.04.1","3.16.0-36.48~14.04.1","3.16.0-37.49~14.04.1","3.16.0-37.51~14.04.1","3.16.0-38.52~14.04.1","3.16.0-39.53~14.04.1","3.16.0-40.54~14.04.1","3.16.0-41.55~14.04.1","3.16.0-41.57~14.04.1","3.16.0-43.58~14.04.1","3.16.0-44.59~14.04.1","3.16.0-45.60~14.04.1","3.16.0-46.62~14.04.1","3.16.0-48.64~14.04.1","3.16.0-49.65~14.04.1","3.16.0-50.66~14.04.1","3.16.0-50.67~14.04.1","3.16.0-51.69~14.04.1","3.16.0-52.71~14.04.1","3.16.0-53.72~14.04.1","3.16.0-55.74~14.04.1","3.16.0-56.75~14.04.1","3.16.0-57.77~14.04.1","3.16.0-59.79~14.04.1","3.16.0-60.80~14.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-51.57~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1","3.19.0-20.20~14.04.1","3.19.0-21.21~14.04.1","3.19.0-22.22~14.04.1","3.19.0-23.24~14.04.1","3.19.0-25.26~14.04.1","3.19.0-26.28~14.04.1","3.19.0-28.30~14.04.1","3.19.0-30.33~14.04.1","3.19.0-30.34~14.04.1","3.19.0-31.36~14.04.1","3.19.0-32.37~14.04.1","3.19.0-33.38~14.04.1","3.19.0-37.42~14.04.1","3.19.0-39.44~14.04.1","3.19.0-41.46~14.04.2","3.19.0-42.48~14.04.1","3.19.0-43.49~14.04.1","3.19.0-47.53~14.04.1","3.19.0-49.55~14.04.1"],"bundled":7}],"products":[{"vendor":"canonical","product":"ubuntu_core"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"canonical","product":"ubuntu_touch"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://launchpadlibrarian.net/235300093/0005-overlayfs-Be-more-careful-about-copying-up-sxid-file.patch","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://launchpadlibrarian.net/235300225/0006-overlayfs-Propogate-nosuid-from-lower-and-upper-moun.patch","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9f57ebcba563e0cd532926cab83c92bb4d79360","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Vendor Advisory","fix"]},{"url":"https://bugs.launchpad.net/bugs/1535150","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/02/24/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1576.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.halfdog.net/Security/2016/OverlayfsOverFusePrivilegeEscalation/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/18/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1576"},{"url":"http://www.halfdog.net/Security/2016/OverlayfsOverFusePrivilegeEscalation"},{"url":"https://github.com/advisories/GHSA-6774-jh98-f2hq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1576","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-1576","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2910-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2908-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2908-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2907-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2909-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2907-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2908-2","tags":["advisory"]},{"url":"https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/trusty/commit/?id=ce550fb847b34553e63ee95386de59a1096fbfc4","tags":["report"]},{"url":"https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/trusty/commit/?id=d77014a9527a4544797b9f1f2026b8e9fe032355","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8785","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1575","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4312","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2069","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-1576","description":"The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.","status":"published","published":"2016-05-02T10:00:00Z","modified":"2024-08-05T23:02:11.745Z","updated_at":"2026-11-02T14:33:35.488991Z"}],"euvd":[{"id":"EUVD-2016-2671","description":"The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.","status":"published","published":"2016-05-02T10:00:00Z","modified":"2024-08-05T23:02:11Z","updated_at":"2026-11-03T02:22:56.538135Z"}],"ghsa":[{"id":"GHSA-6774-jh98-f2hq","title":"The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the...","description":"The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.","status":"published","published":"2022-05-13T01:02:15Z","modified":"2025-04-12T13:00:26Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:01:27.480327Z"}],"nvd":[{"id":"CVE-2016-1576","description":"The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.","status":"published","published":"2016-05-02T10:59:24.487Z","modified":"2026-06-17T00:42:11.853Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:03:23.795791Z"}],"osv":[{"id":"CVE-2016-1576","description":"The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.","status":"published","published":"2016-05-02T10:59:24.487Z","modified":"2026-03-15T22:05:16.114564Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-1576","description":"The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.","status":"published","published":"2016-05-02T10:59:24.487Z","modified":"2026-09-22T07:01:25.939950149Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-1576","description":"The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program.","status":"published","published":"2016-02-22T00:00:00Z","modified":"2026-04-22T10:31:23.177069Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"USN-2907-1","title":"linux vulnerabilities","description":"halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,\nincorrectly propagated file attributes, including setuid. A local\nunprivileged attacker could use this to gain privileges. (CVE-2016-1576)\n\nhalfdog discovered that OverlayFS in the Linux kernel incorrectly\npropagated security sensitive extended attributes, such as\nPOSIX ACLs. A local unprivileged attacker could use this to gain\nprivileges. (CVE-2016-1575)\n\nIt was discovered that the Linux kernel keyring subsystem contained a race\nbetween read and revoke operations. A local attacker could use this to\ncause a denial of service (system crash). (CVE-2015-7550)\n\n郭永刚 discovered that the Linux kernel networking implementation did\nnot validate protocol identifiers for certain protocol families, A local\nattacker could use this to cause a denial of service (system crash) or\npossibly gain administrative privileges. (CVE-2015-8543)\n\nDmitry Vyukov discovered that the pptp implementation in the Linux kernel\ndid not verify an address length when setting up a socket. A local attacker\ncould use this to craft an application that exposed sensitive information\nfrom kernel memory. (CVE-2015-8569)\n\nDavid Miller discovered that the Bluetooth implementation in the Linux\nkernel did not properly validate the socket address length for Synchronous\nConnection-Oriented (SCO) sockets. A local attacker could use this to\nexpose sensitive information. (CVE-2015-8575)\n\nIt was discovered that the Linux kernel's Filesystem in Userspace (FUSE)\nimplementation did not handle initial zero length segments properly. A\nlocal attacker could use this to cause a denial of service (unkillable\ntask). (CVE-2015-8785)\n","status":"published","published":"2016-02-22T19:44:22Z","modified":"2026-04-22T09:21:48.640081Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-2908-2","title":"linux-lts-wily vulnerabilities","description":"halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,\nincorrectly propagated file attributes, including setuid. A local\nunprivileged attacker could use this to gain privileges. (CVE-2016-1576)\n\nhalfdog discovered that OverlayFS in the Linux kernel incorrectly\npropagated security sensitive extended attributes, such as POSIX ACLs. A\nlocal unprivileged attacker could use this to gain privileges.\n(CVE-2016-1575)\n\nIt was discovered that the Linux kernel did not properly enforce rlimits\nfor file descriptors sent over UNIX domain sockets. A local attacker could\nuse this to cause a denial of service. (CVE-2013-4312)\n\nIt was discovered that the Linux kernel's Filesystem in Userspace (FUSE)\nimplementation did not handle initial zero length segments properly. A\nlocal attacker could use this to cause a denial of service (unkillable\ntask). (CVE-2015-8785)\n\nAndy Lutomirski discovered a race condition in the Linux kernel's\ntranslation lookaside buffer (TLB) handling of flush events. A local\nattacker could use this to cause a denial of service or possibly leak\nsensitive information. (CVE-2016-2069)\n","status":"published","published":"2016-02-22T20:42:03Z","modified":"2026-02-10T04:40:57Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-2909-1","title":"linux-lts-utopic vulnerabilities","description":"halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,\nincorrectly propagated file attributes, including setuid. A local\nunprivileged attacker could use this to gain privileges. (CVE-2016-1576)\n\nhalfdog discovered that OverlayFS in the Linux kernel incorrectly\npropagated security sensitive extended attributes, such as POSIX ACLs. A\nlocal unprivileged attacker could use this to gain privileges.\n(CVE-2016-1575)\n\nIt was discovered that the Linux kernel's Filesystem in Userspace (FUSE)\nimplementation did not handle initial zero length segments properly. A\nlocal attacker could use this to cause a denial of service (unkillable\ntask). (CVE-2015-8785)\n","status":"published","published":"2016-02-22T21:09:23Z","modified":"2026-02-10T04:40:57Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-2910-1","title":"linux-lts-vivid vulnerabilities","description":"halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,\nincorrectly propagated file attributes, including setuid. A local\nunprivileged attacker could use this to gain privileges. (CVE-2016-1576)\n\nhalfdog discovered that OverlayFS in the Linux kernel incorrectly\npropagated security sensitive extended attributes, such as POSIX ACLs. A\nlocal unprivileged attacker could use this to gain privileges.\n(CVE-2016-1575)\n\nIt was discovered that the Linux kernel keyring subsystem contained a race\nbetween read and revoke operations. A local attacker could use this to\ncause a denial of service (system crash). (CVE-2015-7550)\n\n郭永刚 discovered that the Linux kernel networking implementation did\nnot validate protocol identifiers for certain protocol families, A local\nattacker could use this to cause a denial of service (system crash) or\npossibly gain administrative privileges. (CVE-2015-8543)\n\nDmitry Vyukov discovered that the pptp implementation in the Linux kernel\ndid not verify an address length when setting up a socket. A local attacker\ncould use this to craft an application that exposed sensitive information\nfrom kernel memory. (CVE-2015-8569)\n\nDavid Miller discovered that the Bluetooth implementation in the Linux\nkernel did not properly validate the socket address length for Synchronous\nConnection-Oriented (SCO) sockets. A local attacker could use this to\nexpose sensitive information. (CVE-2015-8575)\n\nIt was discovered that the Linux kernel's Filesystem in Userspace (FUSE)\nimplementation did not handle initial zero length segments properly. A\nlocal attacker could use this to cause a denial of service (unkillable\ntask). (CVE-2015-8785)\n","status":"published","published":"2016-02-22T21:24:38Z","modified":"2026-02-10T04:40:57Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}