Description
Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec. NOTE: this vulnerability exists because of a CVE-2012-6701 regression.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 4.1.3-1 | — |
| Debian 13 | linux | 4.1.3-1 | — |
| Debian 12 | linux | 4.1.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | linux | 3.13.0-86.130 | USN-2968-1 |
| Ubuntu 14.04 LTS | linux-lts-utopic | 3.16.0-71.91~14.04.1 | USN-2969-1 |
| Ubuntu 14.04 LTS | linux-lts-vivid | 3.19.0-59.65~14.04.1 | USN-2970-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | kernel-rt +10 | 3.10.0-957.rt56.910.el7 | RHSA-2018:3096 |
| RHEL 7 | perf +18 | 3.10.0-957.el7 | RHSA-2018:3083 |
| RHEL 6 | perf +16 | 2.6.32-754.el6 | RHSA-2018:1854 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | perf +12 | 3.10.0-957.el7 | ELSA-2018-3083 |
Advisories 7
- RHSA-2018:3083 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 8, 2026
- RHSA-2018:3096 Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 8, 2026
- RHSA-2018:1854 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- USN-2968-1 linux vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-2969-1 linux-lts-utopic vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-2970-1 linux-lts-vivid vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- ELSA-2018-3083 Important: kernel security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 5, 2018
References
- RHSA-2018:3083 vendor-advisory
- https://github.com/torvalds/linux/commit/4c185ce06dca14f5cea192f5a2c981ef50663f2b
- USN-2970-1 vendor-advisory
- RHSA-2018:1854 vendor-advisory
- DSA-3503 vendor-advisory
- USN-2969-1 vendor-advisory
- USN-2968-1 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1314275
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c4f4b82694fe48b02f7a881a1797131a6dad1364
- USN-2968-2 vendor-advisory
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4c185ce06dca14f5cea192f5a2c981ef50663f2b
- [oss-security] 20160302 Re: CVE Request: Linux: aio write triggers integer overflow in some network protocols mailing-list
- RHSA-2018:3096 vendor-advisory
- https://github.com/torvalds/linux/commit/c4f4b82694fe48b02f7a881a1797131a6dad1364