{"id":"CVE-2016-5400","aliases":["DEBIAN-CVE-2016-5400","EUVD-2016-6345","GHSA-m677-x4w4-vj2w","MGASA-2016-0345","MGASA-2016-0364","UBUNTU-CVE-2016-5400","USN-3070-1","USN-3070-2","USN-3070-3","USN-3070-4"],"status":"published","title":"Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB...","description":"Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations.","severity":{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00374,"percentile":0.31563,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2016-08-06T00:00:00Z","modified":"2026-09-22T07:00:50Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.7.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","fixed_in":["3.19.0-68.76~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","fixed_in":["4.4.0-36.55~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux","fixed_in":["4.4.0-36.55"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","fixed_in":["4.4.0-1021.27"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","fixed_in":["4.4.0-1024.27"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.22-1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.22-1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-6.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.2-6.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-12.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.26-1.mga5"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-68.76~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1","3.19.0-20.20~14.04.1","3.19.0-21.21~14.04.1","3.19.0-22.22~14.04.1","3.19.0-23.24~14.04.1","3.19.0-25.26~14.04.1","3.19.0-26.28~14.04.1","3.19.0-28.30~14.04.1","3.19.0-30.33~14.04.1","3.19.0-30.34~14.04.1","3.19.0-31.36~14.04.1","3.19.0-32.37~14.04.1","3.19.0-33.38~14.04.1","3.19.0-37.42~14.04.1","3.19.0-39.44~14.04.1","3.19.0-41.46~14.04.2","3.19.0-42.48~14.04.1","3.19.0-43.49~14.04.1","3.19.0-47.53~14.04.1","3.19.0-49.55~14.04.1","3.19.0-51.57~14.04.1","3.19.0-51.58~14.04.1","3.19.0-56.62~14.04.1","3.19.0-58.64~14.04.1","3.19.0-59.65~14.04.1","3.19.0-59.66~14.04.1","3.19.0-61.69~14.04.1","3.19.0-64.72~14.04.1","3.19.0-65.73~14.04.1","3.19.0-66.74~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-36.55~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-36.55"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1021.27"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16","4.4.0-1016.22","4.4.0-1017.23","4.4.0-1019.25"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1024.27"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18","4.4.0-1019.22","4.4.0-1020.23","4.4.0-1022.25"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-36.55"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1021.27"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16","4.4.0-1016.22","4.4.0-1017.23","4.4.0-1019.25"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1024.27"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18","4.4.0-1019.22","4.4.0-1020.23","4.4.0-1022.25"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-36.55~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1"],"bundled":8}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-3070-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=aa93d1fee85c890a34f2510a310e55ee76a27848","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1358184","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://www.ubuntu.com/usn/USN-3070-3","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/07/25/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3070-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.securitytracker.com/id/1036432","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-3070-4","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://github.com/torvalds/linux/commit/aa93d1fee85c890a34f2510a310e55ee76a27848","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"http://www.securityfocus.com/bid/92104","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5400"},{"url":"https://github.com/advisories/GHSA-m677-x4w4-vj2w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-5400","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0345.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19397","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19390","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.17","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.18","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.19","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.20","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.21","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.22","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2016-0364.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19639","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.23","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.24","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.25","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.26","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-5400","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3070-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3070-4","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3070-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3070-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5400","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-1237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5696","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5828","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5829","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6197","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-5400","description":"Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations.","status":"published","published":"2016-08-06T20:00:00Z","modified":"2024-08-06T01:00:59.895Z","updated_at":"2026-11-02T14:33:30.767029Z"}],"euvd":[{"id":"EUVD-2016-6345","description":"Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations.","status":"published","published":"2016-08-06T20:00:00Z","modified":"2024-08-06T01:00:59Z","updated_at":"2026-11-03T02:22:42.442421Z"}],"ghsa":[{"id":"GHSA-m677-x4w4-vj2w","title":"Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB...","description":"Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations.","status":"published","published":"2022-05-17T01:19:29Z","modified":"2023-02-03T05:03:51Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:53:26.410699Z"}],"nvd":[{"id":"CVE-2016-5400","description":"Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations.","status":"published","published":"2016-08-06T20:59:02.72Z","modified":"2026-06-17T00:49:20.543Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:28.854267Z"}],"osv":[{"id":"CVE-2016-5400","description":"Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations.","status":"published","published":"2016-08-06T20:59:02.72Z","modified":"2026-04-16T06:24:34.918750522Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-5400","description":"Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations.","status":"published","published":"2016-08-06T20:59:02.72Z","modified":"2026-09-22T07:00:50.460565365Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"UBUNTU-CVE-2016-5400","description":"Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations.","status":"published","published":"2016-08-06T00:00:00Z","modified":"2026-04-22T10:51:41.357305Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"MGASA-2016-0345","title":"Updated kernel packages fixes security vulnerablilities","description":"This update is based on the upstream 4.4.22 kernel and fixes at least theese\nsecurity issues:\n\nsound/core/timer.c in the Linux kernel through 4.6 does not initialize \ncertain r1 data structures, which allows local users to obtain sensitive\ninformation from kernel stack memory via crafted use of the ALSA timer\ninterface, related to the (1) snd_timer_user_ccallback and (2)\nsnd_timer_user_tinterrupt functions (CVE-2016-4578).\n\nThe tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the\nLinux kernel through 4.6.3 does not properly copy a certain string, which\nallows local users to obtain sensitive information from kernel stack memory\nby reading a Netlink message (CVE-2016-5243).\n\nThe rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through\n4.6.3 does not initialize a certain structure member, which allows remote\nattackers to obtain sensitive information from kernel stack memory by reading\nan RDS message (CVE-2016-5244).\n\nMemory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c\nin the airspy USB driver in the Linux kernel before 4.7 allows local users \nto cause a denial of service (memory consumption) via a crafted USB device\nthat emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many\nconnect and disconnect operations (CVE-2016-5400).\n\nRace condition in the ioctl_send_fib function in drivers/scsi/aacraid/\ncommctrl.c in the Linux kernel through 4.7 allows local users to cause a\ndenial of service (out-of-bounds access or system crash) by changing a\ncertain size value, aka a \"double fetch\" vulnerability (CVE-2016-6480).\n\nThis update also changes the following:\n- enables STRICT_DEVMEM as a security hardening\n- disables FW_LOADER_USER_HELPER_FALLBACK again (un-intentionally \n  enabled in 4.4 series upgrade) that slows down boot or even makes\n  wireless connection fail with drivers with multiple possible\n  firmwares (mga#19390).\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2016-10-18T18:43:39Z","modified":"2026-04-16T06:24:58.353394073Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2016-0364","title":"Updated kernel-tmb package fixes security issues","description":"This update is based on the upstream 4.4.26 kernel and fixes at least\nthese security issues:\n\nsound/core/timer.c in the Linux kernel through 4.6 does not initialize\ncertain r1 data structures, which allows local users to obtain sensitive\ninformation from kernel stack memory via crafted use of the ALSA timer\ninterface, related to the (1) snd_timer_user_ccallback and (2)\nsnd_timer_user_tinterrupt functions (CVE-2016-4578).\n\nA race condition was found in the way the Linux kernel's memory subsystem\nhandled the copy-on-write (COW) breakage of private read-only memory\nmappings. An unprivileged local user could use this flaw to gain write\naccess to otherwise read-only memory mappings and thus increase their\nprivileges on the system. This could be abused by an attacker to modify\nexisting setuid files with instructions to elevate privileges. An exploit\nusing this technique has been found in the wild (CVE-2016-5195).\n\nThe tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the\nLinux kernel through 4.6.3 does not properly copy a certain string, which\nallows local users to obtain sensitive information from kernel stack\nmemory by reading a Netlink message (CVE-2016-5243).\n\nThe rds_inc_info_copy function in net/rds/recv.c in the Linux kernel\nthrough 4.6.3 does not initialize a certain structure member, which\nallows remote attackers to obtain sensitive information from kernel\nstack memory by reading an RDS message (CVE-2016-5244).\n\nMemory leak in the airspy_probe function in\ndrivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux\nkernel before 4.7 allows local users to cause a denial of service (memory\nconsumption) via a crafted USB device that emulates many VFL_TYPE_SDR or\nVFL_TYPE_SUBDEV devices and performs many connect and disconnect\noperations (CVE-2016-5400).\n\nRace condition in the ioctl_send_fib function in\ndrivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows\nlocal users to cause a denial of service (out-of-bounds access or system\ncrash) by changing a certain size value, aka a \"double fetch\"\nvulnerability (CVE-2016-6480).\n\nMarco Grassi discovered a use-after-free condition could occur in the TCP\nretransmit queue handling code in the Linux kernel. A local attacker\ncould   use this to cause a denial of service (system crash) or possibly\nexecute arbitrary code. (CVE-2016-6828)\n\nVladimir Bene discovered an unbounded recursion in the VLAN and TEB\nGeneric Receive Offload (GRO) processing implementations in the Linux\nkernel, A remote attacker could use this to cause a stack corruption,\nleading to a denial of service (system crash). (CVE-2016-7039)\n\nThis update also changes the following:\n- enables STRICT_DEVMEM as a security hardening\n- disables FW_LOADER_USER_HELPER_FALLBACK again (un-intentionally \nenabled in 4.4 series upgrade) that slows down boot or even makes\nwireless connection fail with drivers with multiple possible\nfirmwares (mga#19390).\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2016-11-04T08:43:04Z","modified":"2026-04-16T06:23:37.6385727Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"USN-3070-1","title":"linux vulnerabilities","description":"A missing permission check when settings ACLs was discovered in nfsd. A\nlocal user could exploit this flaw to gain access to any file by setting an\nACL. (CVE-2016-1237)\n\nKangjie Lu discovered an information leak in the Reliable Datagram Sockets\n(RDS) implementation in the Linux kernel. A local attacker could use this\nto obtain potentially sensitive information from kernel memory.\n(CVE-2016-5244)\n\nJames Patrick-Evans discovered that the airspy USB device driver in the\nLinux kernel did not properly handle certain error conditions. An attacker\nwith physical access could use this to cause a denial of service (memory\nconsumption). (CVE-2016-5400)\n\nYue Cao et al discovered a flaw in the TCP implementation's handling of\nchallenge acks in the Linux kernel. A remote attacker could use this to\ncause a denial of service (reset connection) or inject content into an TCP\nstream. (CVE-2016-5696)\n\nPengfei Wang discovered a race condition in the MIC VOP driver in the Linux\nkernel. A local attacker could use this to cause a denial of service\n(system crash) or obtain potentially sensitive information from kernel\nmemory. (CVE-2016-5728)\n\nCyril Bur discovered that on PowerPC platforms, the Linux kernel mishandled\ntransactional memory state on exec(). A local attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2016-5828)\n\nIt was discovered that a heap based buffer overflow existed in the USB HID\ndriver in the Linux kernel. A local attacker could use this cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2016-5829)\n\nIt was discovered that the OverlayFS implementation in the Linux kernel did\nnot properly verify dentry state before proceeding with unlink and rename\noperations. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2016-6197)\n","status":"published","published":"2016-08-29T19:01:14Z","modified":"2026-04-22T09:27:27.144137Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3070-2","title":"linux-raspi2 vulnerabilities","description":"A missing permission check when settings ACLs was discovered in nfsd. A\nlocal user could exploit this flaw to gain access to any file by setting an\nACL. (CVE-2016-1237)\n\nKangjie Lu discovered an information leak in the Reliable Datagram Sockets\n(RDS) implementation in the Linux kernel. A local attacker could use this\nto obtain potentially sensitive information from kernel memory.\n(CVE-2016-5244)\n\nJames Patrick-Evans discovered that the airspy USB device driver in the\nLinux kernel did not properly handle certain error conditions. An attacker\nwith physical access could use this to cause a denial of service (memory\nconsumption). (CVE-2016-5400)\n\nYue Cao et al discovered a flaw in the TCP implementation's handling of\nchallenge acks in the Linux kernel. A remote attacker could use this to\ncause a denial of service (reset connection) or inject content into an TCP\nstream. (CVE-2016-5696)\n\nPengfei Wang discovered a race condition in the MIC VOP driver in the Linux\nkernel. A local attacker could use this to cause a denial of service\n(system crash) or obtain potentially sensitive information from kernel\nmemory. (CVE-2016-5728)\n\nCyril Bur discovered that on PowerPC platforms, the Linux kernel mishandled\ntransactional memory state on exec(). A local attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2016-5828)\n\nIt was discovered that a heap based buffer overflow existed in the USB HID\ndriver in the Linux kernel. A local attacker could use this cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2016-5829)\n\nIt was discovered that the OverlayFS implementation in the Linux kernel did\nnot properly verify dentry state before proceeding with unlink and rename\noperations. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2016-6197)\n","status":"published","published":"2016-08-30T16:22:36Z","modified":"2026-02-10T04:41:02Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3070-3","title":"linux-snapdragon vulnerabilities","description":"A missing permission check when settings ACLs was discovered in nfsd. A\nlocal user could exploit this flaw to gain access to any file by setting an\nACL. (CVE-2016-1237)\n\nKangjie Lu discovered an information leak in the Reliable Datagram Sockets\n(RDS) implementation in the Linux kernel. A local attacker could use this\nto obtain potentially sensitive information from kernel memory.\n(CVE-2016-5244)\n\nJames Patrick-Evans discovered that the airspy USB device driver in the\nLinux kernel did not properly handle certain error conditions. An attacker\nwith physical access could use this to cause a denial of service (memory\nconsumption). (CVE-2016-5400)\n\nYue Cao et al discovered a flaw in the TCP implementation's handling of\nchallenge acks in the Linux kernel. A remote attacker could use this to\ncause a denial of service (reset connection) or inject content into an TCP\nstream. (CVE-2016-5696)\n\nPengfei Wang discovered a race condition in the MIC VOP driver in the Linux\nkernel. A local attacker could use this to cause a denial of service\n(system crash) or obtain potentially sensitive information from kernel\nmemory. (CVE-2016-5728)\n\nCyril Bur discovered that on PowerPC platforms, the Linux kernel mishandled\ntransactional memory state on exec(). A local attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2016-5828)\n\nIt was discovered that a heap based buffer overflow existed in the USB HID\ndriver in the Linux kernel. A local attacker could use this cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2016-5829)\n\nIt was discovered that the OverlayFS implementation in the Linux kernel did\nnot properly verify dentry state before proceeding with unlink and rename\noperations. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2016-6197)\n","status":"published","published":"2016-08-30T16:28:23Z","modified":"2026-02-10T04:41:02Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3070-4","title":"linux-lts-xenial vulnerabilities","description":"USN-3070-1 fixed vulnerabilities in the Linux kernel for Ubuntu\n16.04 LTS. This update provides the corresponding updates for the\nLinux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for\nUbuntu 14.04 LTS.\n\nA missing permission check when settings ACLs was discovered in nfsd. A\nlocal user could exploit this flaw to gain access to any file by setting an\nACL. (CVE-2016-1237)\n\nKangjie Lu discovered an information leak in the Reliable Datagram Sockets\n(RDS) implementation in the Linux kernel. A local attacker could use this\nto obtain potentially sensitive information from kernel memory.\n(CVE-2016-5244)\n\nJames Patrick-Evans discovered that the airspy USB device driver in the\nLinux kernel did not properly handle certain error conditions. An attacker\nwith physical access could use this to cause a denial of service (memory\nconsumption). (CVE-2016-5400)\n\nYue Cao et al discovered a flaw in the TCP implementation's handling of\nchallenge acks in the Linux kernel. A remote attacker could use this to\ncause a denial of service (reset connection) or inject content into an TCP\nstream. (CVE-2016-5696)\n\nPengfei Wang discovered a race condition in the MIC VOP driver in the Linux\nkernel. A local attacker could use this to cause a denial of service\n(system crash) or obtain potentially sensitive information from kernel\nmemory. (CVE-2016-5728)\n\nCyril Bur discovered that on PowerPC platforms, the Linux kernel mishandled\ntransactional memory state on exec(). A local attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2016-5828)\n\nIt was discovered that a heap based buffer overflow existed in the USB HID\ndriver in the Linux kernel. A local attacker could use this cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2016-5829)\n\nIt was discovered that the OverlayFS implementation in the Linux kernel did\nnot properly verify dentry state before proceeding with unlink and rename\noperations. A local attacker could use this to cause a denial of service\n(system crash). (CVE-2016-6197)\n","status":"published","published":"2016-08-30T16:47:18Z","modified":"2026-02-10T04:41:02Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}