Description
Multiple race conditions in the Advanced Union Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch patches for the Linux kernel 3.x and 4.x allow local users to cause a denial of service (use-after-free and BUG) or possibly gain privileges via a (1) madvise or (2) msync system call, related to mm/madvise.c and mm/msync.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 4.2.1-1 | — |
| Debian 13 | linux | 4.2.1-1 | — |
| Debian 12 | linux | 4.2.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | linux | 3.13.0-66.108 | USN-2776-1 |
| Ubuntu 14.04 LTS | linux-lts-utopic | 3.16.0-51.69~14.04.1 | USN-2777-1 |
| Ubuntu 14.04 LTS | linux-lts-vivid | 3.19.0-31.36~14.04.1 | USN-2778-1 |
Advisories 3
- USN-2776-1 linux vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-2777-1 linux-lts-utopic vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-2778-1 linux-lts-vivid vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
References
- DSA-3364 vendor-advisory
- [aufs] 20150910 Re: concurrent msync triggers NULL pointer dereference mailing-list
- [oss-security] 20150922 Re: CVE request: Use-after-free in Linux kernel with aufs mmap patch mailing-list
- USN-2777-1 vendor-advisory