{"id":"CVE-2016-9120","aliases":["DEBIAN-CVE-2016-9120","EUVD-2016-9940","GHSA-m72g-wmm2-j9fv","MGASA-2017-0136","MGASA-2017-0147","MGASA-2017-0148","UBUNTU-CVE-2016-9120"],"status":"published","title":"Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel...","description":"Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01736,"percentile":0.77821,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264","CWE-416"],"published":"2016-12-08T21:00:00Z","modified":"2026-09-22T07:03:13Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.6.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.65-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.65-1.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.22-2.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.22-2.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-37.mga5"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.68-1.mga5"}]}],"bundled":15},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.68-1.mga5"}]}],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://github.com/torvalds/linux/commit/9590232bb4f4cc824f3425a6e1349afbe6d6d2b7","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9590232bb4f4cc824f3425a6e1349afbe6d6d2b7","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/94669","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://source.android.com/security/bulletin/2016-12-01.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9120"},{"url":"https://github.com/advisories/GHSA-m72g-wmm2-j9fv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-9120","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0136.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20747","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.60","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.61","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.62","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.63","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.64","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.65","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2017-0147.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20859","tags":["report"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.66","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.67","tags":["web"]},{"url":"https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.68","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2017-0148.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20860","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9120","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9120","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-9120","description":"Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time.","status":"published","published":"2016-12-08T21:00:00Z","modified":"2024-08-06T02:42:10.935Z","updated_at":"2026-11-02T14:33:32.103757Z"}],"euvd":[{"id":"EUVD-2016-9940","description":"Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time.","status":"published","published":"2016-12-08T21:00:00Z","modified":"2024-08-06T02:42:10Z","updated_at":"2026-11-03T02:22:28.196866Z"}],"ghsa":[{"id":"GHSA-m72g-wmm2-j9fv","title":"Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel...","description":"Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time.","status":"published","published":"2022-05-17T03:21:47Z","modified":"2023-01-27T05:06:44Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:42:58.742657Z"}],"nvd":[{"id":"CVE-2016-9120","description":"Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time.","status":"published","published":"2016-12-08T21:59:02.443Z","modified":"2026-06-17T00:55:33.11Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264","CWE-416"],"updated_at":"2026-11-02T14:03:32.79141Z"}],"osv":[{"id":"CVE-2016-9120","description":"Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time.","status":"published","published":"2016-12-08T21:59:02.443Z","modified":"2026-04-16T06:22:41.289892715Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"DEBIAN-CVE-2016-9120","description":"Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time.","status":"published","published":"2016-12-08T21:59:02.443Z","modified":"2026-09-22T07:03:13.306143056Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2016-9120","description":"Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time.","status":"published","published":"2016-12-08T21:59:00Z","modified":"2025-10-24T04:45:57Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"MGASA-2017-0136","title":"Updated kernel packages fixes security vulnerabilities","description":"This kernel update is based on upstream 4.4.65 and fixes at least\nthe following security issues:\n\nfs/namespace.c in the Linux kernel before 4.9 does not restrict how many\nmounts may exist in a mount namespace, which allows local users to cause\na denial of service (memory consumption and deadlock) via MS_BIND mount\nsystem calls, as demonstrated by a loop that triggers exponential growth\nin the number of mounts (CVE-2016-6213).\n\nThe xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in\nthe Linux kernel before 4.6 allows local users to gain privileges or cause\na denial of service (use-after-free) via vectors involving omission of the\nfirmware name from a certain data structure (CVE-2016-7913).\n\nThe nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux\nkernel before 4.5 does not check whether a batch message's length field is\nlarge enough, which allows local users to obtain sensitive information from\nkernel memory or cause a denial of service (infinite loop or out-of-bounds\nread) by leveraging the CAP_NET_ADMIN capability (CVE-2016-7917).\n\nThe tipc_msg_build function in net/tipc/msg.c in the Linux kernel through\n4.8.11 does not validate the relationship between the minimum fragment\nlength and the maximum packet size, which allows local users to gain\nprivileges or cause a denial of service (heap-based buffer overflow) by\nleveraging the CAP_NET_ADMIN capability (CVE-2016-8632).\n\ndrivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local\nusers to bypass integer overflow checks, and cause a denial of service\n(memory corruption) or have unspecified other impact, by leveraging access\nto a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call, aka a\n\"state machine confusion bug\" (CVE-2016-9083).\n\ndrivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11\nmisuses the kzalloc function, which allows local users to cause a denial\nof service (integer overflow) or have unspecified other impact by\nleveraging access to a vfio PCI device file (CVE-2016-9084).\n\nIt was discovered that root can gain direct access to an internal keyring,\nsuch as '.builtin_trusted_keys' upstream, by joining it as its session\nkeyring. This allows root to bypass module signature verification by adding\na new public key of its own devising to the keyring (CVE-2016-9604).\n\nThe ping_unhash function in net/ipv4/ping.c in the Linux kernel through\n4.10.8 is too late in obtaining a certain lock and consequently cannot\nensure that disconnect function calls are safe, which allows local users\nto cause a denial of service (panic) by leveraging access to the protocol\nvalue of IPPROTO_ICMP in a socket system call (CVE-2017-2671).\n\nRace condition in kernel/events/core.c in the Linux kernel before 4.9.7\nallows local users to gain privileges via a crafted application that makes\nconcurrent perf_event_open system calls for moving a software group into a\nhardware context. NOTE: this vulnerability exists because of an incomplete\nfix for CVE-2016-6786 (CVE-2017-6001).\n\nThe keyring_search_aux function in security/keys/keyring.c in the Linux\nkernel through 3.14.79 allows local users to cause a denial of service\n(NULL pointer dereference and OOPS) via a request_key system call for the\n\"dead\" type (CVE-2017-6951).\n\nThe packet_set_ring function in net/packet/af_packet.c in the Linux kernel\nthrough 4.10.6 does not properly validate certain block-size data, which\nallows local users to cause a denial of service (overflow) or possibly have\nunspecified other impact via crafted system calls (CVE-2017-7308).\n\nA vulnerability was found in the Linux kernel. It was found that\nkeyctl_set_reqkey_keyring() function leaks thread keyring which allows\nunprivileged local user to exhaust kernel memory (CVE-2017-7472).\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2017-05-10T20:47:44Z","modified":"2026-04-16T06:23:14.218484255Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2017-0147","title":"Updated kernel-tmb packages fixes security vulnerabilities","description":"This kernel-tmb update is based on upstream 4.4.68 and fixes at least\nthe following security issues:\n\nfs/namespace.c in the Linux kernel before 4.9 does not restrict how many\nmounts may exist in a mount namespace, which allows local users to cause\na denial of service (memory consumption and deadlock) via MS_BIND mount\nsystem calls, as demonstrated by a loop that triggers exponential growth\nin the number of mounts (CVE-2016-6213).\n\nThe xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in\nthe Linux kernel before 4.6 allows local users to gain privileges or cause\na denial of service (use-after-free) via vectors involving omission of the\nfirmware name from a certain data structure (CVE-2016-7913).\n\nThe nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux\nkernel before 4.5 does not check whether a batch message's length field is\nlarge enough, which allows local users to obtain sensitive information from\nkernel memory or cause a denial of service (infinite loop or out-of-bounds\nread) by leveraging the CAP_NET_ADMIN capability (CVE-2016-7917).\n\nThe tipc_msg_build function in net/tipc/msg.c in the Linux kernel through\n4.8.11 does not validate the relationship between the minimum fragment\nlength and the maximum packet size, which allows local users to gain\nprivileges or cause a denial of service (heap-based buffer overflow) by\nleveraging the CAP_NET_ADMIN capability (CVE-2016-8632).\n\ndrivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local\nusers to bypass integer overflow checks, and cause a denial of service\n(memory corruption) or have unspecified other impact, by leveraging access\nto a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call, aka a\n\"state machine confusion bug\" (CVE-2016-9083).\n\ndrivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11\nmisuses the kzalloc function, which allows local users to cause a denial\nof service (integer overflow) or have unspecified other impact by\nleveraging access to a vfio PCI device file (CVE-2016-9084).\n\nIt was discovered that root can gain direct access to an internal keyring,\nsuch as '.builtin_trusted_keys' upstream, by joining it as its session\nkeyring. This allows root to bypass module signature verification by adding\na new public key of its own devising to the keyring (CVE-2016-9604).\n\nThe ping_unhash function in net/ipv4/ping.c in the Linux kernel through\n4.10.8 is too late in obtaining a certain lock and consequently cannot\nensure that disconnect function calls are safe, which allows local users\nto cause a denial of service (panic) by leveraging access to the protocol\nvalue of IPPROTO_ICMP in a socket system call (CVE-2017-2671).\n\nRace condition in kernel/events/core.c in the Linux kernel before 4.9.7\nallows local users to gain privileges via a crafted application that makes\nconcurrent perf_event_open system calls for moving a software group into a\nhardware context. NOTE: this vulnerability exists because of an incomplete\nfix for CVE-2016-6786 (CVE-2017-6001).\n\nThe keyring_search_aux function in security/keys/keyring.c in the Linux\nkernel through 3.14.79 allows local users to cause a denial of service\n(NULL pointer dereference and OOPS) via a request_key system call for the\n\"dead\" type (CVE-2017-6951).\n\nThe packet_set_ring function in net/packet/af_packet.c in the Linux kernel\nthrough 4.10.6 does not properly validate certain block-size data, which\nallows local users to cause a denial of service (overflow) or possibly have\nunspecified other impact via crafted system calls (CVE-2017-7308).\n\nA vulnerability was found in the Linux kernel. It was found that\nkeyctl_set_reqkey_keyring() function leaks thread keyring which allows\nunprivileged local user to exhaust kernel memory (CVE-2017-7472).\n\nThe NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through\n4.10.11 allows remote attackers to cause a denial of service (system crash)\nvia a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and\nfs/nfsd/nfsxdr.c (CVE-2017-7645).\n\nThe NFSv2 and NFSv3 server implementations in the Linux kernel through\n4.10.13 lack certain checks for the end of a buffer, which allows remote\nattackers to trigger pointer-arithmetic errors or possibly have unspecified\nother impact via crafted requests, related to fs/nfsd/nfs3xdr.c and\nfs/nfsd/nfsxdr.c (CVE-2017-7895).\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2017-05-26T06:54:58Z","modified":"2026-04-16T06:24:55.14066521Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2017-0148","title":"Updated kernel-linus packages fixes security vulnerabilities","description":"This kernel-linus update is based on upstream 4.4.68 and fixes at least\nthe following security issues:\n\nfs/namespace.c in the Linux kernel before 4.9 does not restrict how many\nmounts may exist in a mount namespace, which allows local users to cause\na denial of service (memory consumption and deadlock) via MS_BIND mount\nsystem calls, as demonstrated by a loop that triggers exponential growth\nin the number of mounts (CVE-2016-6213).\n\nThe xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in\nthe Linux kernel before 4.6 allows local users to gain privileges or cause\na denial of service (use-after-free) via vectors involving omission of the\nfirmware name from a certain data structure (CVE-2016-7913).\n\nThe nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux\nkernel before 4.5 does not check whether a batch message's length field is\nlarge enough, which allows local users to obtain sensitive information from\nkernel memory or cause a denial of service (infinite loop or out-of-bounds\nread) by leveraging the CAP_NET_ADMIN capability (CVE-2016-7917).\n\nThe tipc_msg_build function in net/tipc/msg.c in the Linux kernel through\n4.8.11 does not validate the relationship between the minimum fragment\nlength and the maximum packet size, which allows local users to gain\nprivileges or cause a denial of service (heap-based buffer overflow) by\nleveraging the CAP_NET_ADMIN capability (CVE-2016-8632).\n\ndrivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local\nusers to bypass integer overflow checks, and cause a denial of service\n(memory corruption) or have unspecified other impact, by leveraging access\nto a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call, aka a\n\"state machine confusion bug\" (CVE-2016-9083).\n\ndrivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11\nmisuses the kzalloc function, which allows local users to cause a denial\nof service (integer overflow) or have unspecified other impact by\nleveraging access to a vfio PCI device file (CVE-2016-9084).\n\nIt was discovered that root can gain direct access to an internal keyring,\nsuch as '.builtin_trusted_keys' upstream, by joining it as its session\nkeyring. This allows root to bypass module signature verification by adding\na new public key of its own devising to the keyring (CVE-2016-9604).\n\nThe ping_unhash function in net/ipv4/ping.c in the Linux kernel through\n4.10.8 is too late in obtaining a certain lock and consequently cannot\nensure that disconnect function calls are safe, which allows local users\nto cause a denial of service (panic) by leveraging access to the protocol\nvalue of IPPROTO_ICMP in a socket system call (CVE-2017-2671).\n\nRace condition in kernel/events/core.c in the Linux kernel before 4.9.7\nallows local users to gain privileges via a crafted application that makes\nconcurrent perf_event_open system calls for moving a software group into a\nhardware context. NOTE: this vulnerability exists because of an incomplete\nfix for CVE-2016-6786 (CVE-2017-6001).\n\nThe keyring_search_aux function in security/keys/keyring.c in the Linux\nkernel through 3.14.79 allows local users to cause a denial of service\n(NULL pointer dereference and OOPS) via a request_key system call for the\n\"dead\" type (CVE-2017-6951).\n\nThe packet_set_ring function in net/packet/af_packet.c in the Linux kernel\nthrough 4.10.6 does not properly validate certain block-size data, which\nallows local users to cause a denial of service (overflow) or possibly have\nunspecified other impact via crafted system calls (CVE-2017-7308).\n\nA vulnerability was found in the Linux kernel. It was found that\nkeyctl_set_reqkey_keyring() function leaks thread keyring which allows\nunprivileged local user to exhaust kernel memory (CVE-2017-7472).\n\nThe NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through\n4.10.11 allows remote attackers to cause a denial of service (system crash)\nvia a long RPC reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and\nfs/nfsd/nfsxdr.c (CVE-2017-7645).\n\nThe NFSv2 and NFSv3 server implementations in the Linux kernel through\n4.10.13 lack certain checks for the end of a buffer, which allows remote\nattackers to trigger pointer-arithmetic errors or possibly have unspecified\nother impact via crafted requests, related to fs/nfsd/nfs3xdr.c and\nfs/nfsd/nfsxdr.c (CVE-2017-7895).\n\nFor other upstream fixes in this update, see the referenced changelogs.\n","status":"published","published":"2017-05-26T06:54:58Z","modified":"2026-04-16T06:25:22.878869572Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}