{"id":"CVE-2016-6156","aliases":["DEBIAN-CVE-2016-6156","EUVD-2016-7090","GHSA-v2x3-97gq-36gp","UBUNTU-CVE-2016-6156","USN-3084-1","USN-3084-2","USN-3084-3","USN-3084-4"],"status":"published","title":"Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in...","description":"Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing a certain size value, aka a \"double fetch\" vulnerability.","severity":{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00274,"percentile":0.19935,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2016-08-06T00:00:00Z","modified":"2026-09-22T07:01:45Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.7.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","fixed_in":["4.4.0-38.57~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux","fixed_in":["4.4.0-38.57"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","fixed_in":["4.4.0-1023.29"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","fixed_in":["4.4.0-1026.29"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-38.57~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1","4.4.0-36.55~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-38.57"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53","4.4.0-36.55"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1023.29"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16","4.4.0-1016.22","4.4.0-1017.23","4.4.0-1019.25","4.4.0-1021.27"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1026.29"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18","4.4.0-1019.22","4.4.0-1020.23","4.4.0-1022.25","4.4.0-1024.27"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-38.57"}]}],"versions":["4.2.0-16.19","4.2.0-17.21","4.2.0-19.23","4.3.0-1.10","4.3.0-2.11","4.3.0-5.16","4.3.0-6.17","4.3.0-7.18","4.4.0-2.16","4.4.0-4.19","4.4.0-6.21","4.4.0-7.22","4.4.0-8.23","4.4.0-9.24","4.4.0-10.25","4.4.0-11.26","4.4.0-12.28","4.4.0-13.29","4.4.0-14.30","4.4.0-15.31","4.4.0-16.32","4.4.0-17.33","4.4.0-18.34","4.4.0-21.37","4.4.0-22.39","4.4.0-22.40","4.4.0-24.43","4.4.0-28.47","4.4.0-31.50","4.4.0-34.53","4.4.0-36.55"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-38.57~14.04.1"}]}],"versions":["4.4.0-13.29~14.04.1","4.4.0-14.30~14.04.2","4.4.0-15.31~14.04.1","4.4.0-18.34~14.04.1","4.4.0-21.37~14.04.1","4.4.0-22.39~14.04.1","4.4.0-22.40~14.04.1","4.4.0-24.43~14.04.1","4.4.0-28.47~14.04.1","4.4.0-31.50~14.04.1","4.4.0-34.53~14.04.1","4.4.0-36.55~14.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1023.29"}]}],"versions":["4.2.0-1013.19","4.2.0-1014.21","4.3.0-1006.6","4.4.0-1003.4","4.4.0-1004.5","4.4.0-1009.10","4.4.0-1010.12","4.4.0-1010.13","4.4.0-1012.16","4.4.0-1016.22","4.4.0-1017.23","4.4.0-1019.25","4.4.0-1021.27"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-snapdragon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1026.29"}]}],"versions":["4.4.0-1012.12","4.4.0-1013.14","4.4.0-1013.15","4.4.0-1015.18","4.4.0-1019.22","4.4.0-1020.23","4.4.0-1022.25","4.4.0-1024.27"],"bundled":3}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=096cdc6f52225835ff503f987a0d68ef770bb78e","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"https://bugzilla.kernel.org/show_bug.cgi?id=120131","tags":["x_refsource_MISC","x_transferred","Issue Tracking","report"]},{"url":"https://github.com/torvalds/linux/commit/096cdc6f52225835ff503f987a0d68ef770bb78e","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"http://www.securityfocus.com/bid/91553","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1353490","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://seclists.org/bugtraq/2016/Jul/20","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6156"},{"url":"https://github.com/advisories/GHSA-v2x3-97gq-36gp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-6156","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-6156","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3084-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3084-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3084-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3084-4","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6156","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-5412","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-6136","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-6156","description":"Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing a certain size value, aka a \"double fetch\" vulnerability.","status":"published","published":"2016-08-06T20:00:00Z","modified":"2024-08-06T01:22:20.646Z","updated_at":"2026-11-02T14:33:34.443637Z"}],"euvd":[{"id":"EUVD-2016-7090","description":"Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing a certain size value, aka a \"double fetch\" vulnerability.","status":"published","published":"2016-08-06T20:00:00Z","modified":"2024-08-06T01:22:20Z","updated_at":"2026-11-03T02:22:40.469928Z"}],"ghsa":[{"id":"GHSA-v2x3-97gq-36gp","title":"Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in...","description":"Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing a certain size value, aka a \"double fetch\" vulnerability.","status":"published","published":"2022-05-17T03:39:45Z","modified":"2023-01-27T05:08:22Z","cvss":[{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:43:17.252355Z"}],"nvd":[{"id":"CVE-2016-6156","description":"Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing a certain size value, aka a \"double fetch\" vulnerability.","status":"published","published":"2016-08-06T20:59:08.05Z","modified":"2026-06-17T00:50:33.107Z","cvss":[{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:03:28.854267Z"}],"osv":[{"id":"CVE-2016-6156","description":"Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing a certain size value, aka a \"double fetch\" vulnerability.","status":"published","published":"2016-08-06T20:59:08.05Z","modified":"2026-03-15T22:09:29.522641Z","cvss":[{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-6156","description":"Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing a certain size value, aka a \"double fetch\" vulnerability.","status":"published","published":"2016-08-06T20:59:08.05Z","modified":"2026-09-22T07:01:45.375823811Z","cvss":[{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"UBUNTU-CVE-2016-6156","description":"Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing a certain size value, aka a \"double fetch\" vulnerability.","status":"published","published":"2016-08-06T00:00:00Z","modified":"2026-04-22T10:54:08.490447Z","cvss":[{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"USN-3084-1","title":"linux vulnerabilities","description":"Pengfei Wang discovered a race condition in the audit subsystem in the\nLinux kernel. A local attacker could use this to corrupt audit logs or\ndisrupt system-call auditing. (CVE-2016-6136)\n\nIt was discovered that the powerpc and powerpc64 hypervisor-mode KVM\nimplementation in the Linux kernel for did not properly maintain state\nabout transactional memory. An unprivileged attacker in a guest could cause\na denial of service (CPU lockup) in the host OS. (CVE-2016-5412)\n\nPengfei Wang discovered a race condition in the Chrome OS embedded\ncontroller device driver in the Linux kernel. A local attacker could use\nthis to cause a denial of service (system crash). (CVE-2016-6156)\n","status":"published","published":"2016-09-19T18:49:00Z","modified":"2026-04-22T09:28:32.025094Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3084-2","title":"linux-lts-xenial vulnerabilities","description":"USN-3084-1 fixed vulnerabilities in the Linux kernel for Ubuntu\n16.04 LTS. This update provides the corresponding updates for the\nLinux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for\nUbuntu 14.04 LTS.\n\nPengfei Wang discovered a race condition in the audit subsystem in the\nLinux kernel. A local attacker could use this to corrupt audit logs or\ndisrupt system-call auditing. (CVE-2016-6136)\n\nIt was discovered that the powerpc and powerpc64 hypervisor-mode KVM\nimplementation in the Linux kernel for did not properly maintain state\nabout transactional memory. An unprivileged attacker in a guest could cause\na denial of service (CPU lockup) in the host OS. (CVE-2016-5412)\n\nPengfei Wang discovered a race condition in the Chrome OS embedded\ncontroller device driver in the Linux kernel. A local attacker could use\nthis to cause a denial of service (system crash). (CVE-2016-6156)\n","status":"published","published":"2016-09-19T18:59:11Z","modified":"2026-02-10T04:41:02Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3084-3","title":"linux-raspi2 vulnerabilities","description":"Pengfei Wang discovered a race condition in the audit subsystem in the\nLinux kernel. A local attacker could use this to corrupt audit logs or\ndisrupt system-call auditing. (CVE-2016-6136)\n\nIt was discovered that the powerpc and powerpc64 hypervisor-mode KVM\nimplementation in the Linux kernel for did not properly maintain state\nabout transactional memory. An unprivileged attacker in a guest could cause\na denial of service (CPU lockup) in the host OS. (CVE-2016-5412)\n\nPengfei Wang discovered a race condition in the Chrome OS embedded\ncontroller device driver in the Linux kernel. A local attacker could use\nthis to cause a denial of service (system crash). (CVE-2016-6156)\n","status":"published","published":"2016-09-19T19:06:12Z","modified":"2026-02-10T04:41:02Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3084-4","title":"linux-snapdragon vulnerabilities","description":"Pengfei Wang discovered a race condition in the audit subsystem in the\nLinux kernel. A local attacker could use this to corrupt audit logs or\ndisrupt system-call auditing. (CVE-2016-6136)\n\nIt was discovered that the powerpc and powerpc64 hypervisor-mode KVM\nimplementation in the Linux kernel for did not properly maintain state\nabout transactional memory. An unprivileged attacker in a guest could cause\na denial of service (CPU lockup) in the host OS. (CVE-2016-5412)\n\nPengfei Wang discovered a race condition in the Chrome OS embedded\ncontroller device driver in the Linux kernel. A local attacker could use\nthis to cause a denial of service (system crash). (CVE-2016-6156)\n","status":"published","published":"2016-09-19T19:12:35Z","modified":"2026-02-10T04:41:02Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}