Description
The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 4.3.3-6 | — |
| Debian 13 | linux | 4.3.3-6 | — |
| Debian 12 | linux | 4.3.3-6 | — |
| Debian 8 | linux | 3.16.7-ckt20-1+deb8u3 | DSA-3448-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | linux | 3.13.0-76.120 | USN-2870-1 |
| Ubuntu 14.04 LTS | linux-lts-utopic | 3.16.0-59.79~14.04.1 | USN-2873-1 |
| Ubuntu 14.04 LTS | linux-lts-vivid | 3.19.0-47.53~14.04.1 | USN-2871-2 |
| Ubuntu 14.04 LTS | linux-lts-wily | 4.2.0-25.30~14.04.1 | USN-2872-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | kernel-rt +7 | 3.10.0-327.4.5.rt56.206.el7_2 | RHSA-2016:0065 |
| RHEL 7 | perf +18 | 3.10.0-327.4.5.el7 | RHSA-2016:0064 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7.1 EUS | kernel-kdump +4 | 3.10.0-229.26.2.el7 | RHSA-2016:0103 |
| RHEL 7.1 EUS | perf +13 | 3.10.0-229.26.2.ael7b | RHSA-2016:0103 |
| Red Hat MRG 2 | kernel-rt +10 | 1:3.10.0-327.rt56.170.el6rt | RHSA-2016:0068 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | kernel-docs | 3.12.51-60.25.2 | SUSE-SU-2016:0186-1 |
| SLES 12 SP1 | kernel-xen +4 | 3.12.51-60.25.1 | SUSE-SU-2016:0186-1 |
| SLES 12 | kernel-docs | 3.12.51-52.39.3 | SUSE-SU-2016:0205-1 |
| SLES 12 | kernel-ec2 +5 | 3.12.51-52.39.1 | SUSE-SU-2016:0205-1, SUSE-SU-2016:0186-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | kernel-xen +3 | 3.12.51-60.25.1 | SUSE-SU-2016:0186-1 |
| SLES for SAP 12 | kernel-xen +3 | 3.12.51-52.39.1 | SUSE-SU-2016:0205-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12-SP1_Update_0 | 3-8.2 | SUSE-SU-2016:0751-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12-SP1_Update_2 | 1-2.2 | SUSE-SU-2016:0752-1, SUSE-SU-2016:0186-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12_Update_10 | 2-2.1 | SUSE-SU-2016:0341-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12_Update_11 | 1-2.3 | SUSE-SU-2016:0205-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12_Update_3 +2 | 5-2.1 | SUSE-SU-2016:0750-1, SUSE-SU-2016:0746-1, SUSE-SU-2016:0745-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12_Update_6 +1 | 4-2.1 | SUSE-SU-2016:0756-1, SUSE-SU-2016:0753-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12_Update_8 +2 | 3-2.1 | SUSE-SU-2016:0757-1, SUSE-SU-2016:0755-1, SUSE-SU-2016:0747-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 4.8.13-1.1 | openSUSE-SU-2024:10128-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | dtrace-modules-3.8.13-118.2.5.el6uek | 0.4.5-3.el6 | ELSA-2016-3509 |
| Oracle Linux 7 | dtrace-modules-3.8.13-118.2.5.el7uek | 0.4.5-3.el7 | ELSA-2016-3509 |
| Oracle Linux 7 | dtrace-modules-4.1.12-32.1.2.el6uek | 0.5.1-1.el6 | ELSA-2016-3510 |
| Oracle Linux 7 | dtrace-modules-4.1.12-32.1.2.el7uek | 0.5.1-1.el7 | ELSA-2016-3510 |
| Oracle Linux 7 | kernel-uek +5 | 3.8.13-118.2.5.el7uek | ELSA-2016-3510, ELSA-2016-3509 |
| Oracle Linux 7 | perf +11 | 3.10.0-327.4.5.el7 | ELSA-2016-0064 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Linux Kernel 4.4.1 - REFCOUNT Overflow Use-After-Free in Keyrings Local Privilege Escalation (1) EDB-39277 · local · Jan 19, 2016
- Linux Kernel 4.4.1 - REFCOUNT Overflow Use-After-Free in Keyrings Local Privilege Escalation (2) EDB-40003 · local · Jan 19, 2016
GitHub 9 repositories
-
nardholio/cve-2016-0728 ★ 22 · Jan 22, 2016
-
bittorrent3389/cve-2016-0728 ★ 7 · Mar 15, 2016
a exploit for cve-2016-0728
-
neuschaefer/cve-2016-0728-testbed ★ 5 · Jan 28, 2016
A testbed for CVE-2016-0728, a refcount leak/overflow bug in Linux
-
kennetham/cve_2016_0728 ★ 3 · Jan 20, 2016
CVE-2016-0728 Linux Kernel Vulnerability
-
sugarvillela/CVE ★ 1 · Dec 3, 2018
A collection of code pertaining to CVE-2016-0728 (various authors)
-
sidrk01/cve-2016-0728 ★ 0 · Dec 4, 2022
Exploit from perception point
-
th30d00r/Linux-Vulnerability-CVE-2016-0728-and-Exploit ★ 0 · May 12, 2020
Document on Linux Kernal Vulnerability CVE-2016-0728 and Exploitation
-
hal0taso/CVE-2016-0728 ★ 0 · May 16, 2017
cve-2016-0728 exploit and summary
-
googleweb/CVE-2016-0728 ★ 0 · Jan 23, 2016
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 27
- RHSA-2016:0103 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:0068 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:0065 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:0064 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-2870-1 linux vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-3448-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2871-2 linux-lts-vivid vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-2872-2 linux-lts-wily vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-2873-1 linux-lts-utopic vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2016:0205-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0750-1 Security update for kernel live patch 5 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10128-1 kernel-debug-4.8.13-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0755-1 Security update for kernel live patch 1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0752-1 Security update for kernel live patch 2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0745-1 Security update for kernel live patch 3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0186-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0747-1 Security update for kernel live patch 9 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0751-1 Security update for kernel live patch 0 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0757-1 Security update for kernel live patch 8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0341-1 Security update for Kernel live patch 10 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0753-1 Security update for kernel live patch 6 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0746-1 Security update for kernel live patch 4 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0756-1 Security update for kernel live patch 7 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0153 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2024
- ELSA-2016-0064 Important: kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 25, 2016
- ELSA-2016-3510 Important: kernel-uek security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 20, 2016
- ELSA-2016-3509 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 20, 2016
References
- 1034701 vdb-entry
- SUSE-SU-2016:0750 vendor-advisory
- USN-2871-1 vendor-advisory
- RHSA-2016:0068 vendor-advisory
- SUSE-SU-2016:0205 vendor-advisory
- USN-2870-2 vendor-advisory
- SUSE-SU-2016:0751 vendor-advisory
- USN-2872-3 vendor-advisory
- SUSE-SU-2016:0747 vendor-advisory
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.1
- SUSE-SU-2016:0755 vendor-advisory
- USN-2872-1 vendor-advisory
- http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/
- SUSE-SU-2016:0757 vendor-advisory
- USN-2871-2 vendor-advisory
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23567fd052a9abb6d67fe8e7a9ccdd9800a540f2
- SUSE-SU-2016:0753 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
- 39277 exploit
- FEDORA-2016-b59fd603be vendor-advisory
- http://source.android.com/security/bulletin/2016-03-01.html
- SUSE-SU-2016:0746 vendor-advisory
- https://github.com/torvalds/linux/commit/23567fd052a9abb6d67fe8e7a9ccdd9800a540f2
- 81054 vdb-entry
- USN-2873-1 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1297475
- FEDORA-2016-5d43766e33 vendor-advisory
- SUSE-SU-2016:0745 vendor-advisory
- RHSA-2016:0065 vendor-advisory
- USN-2870-1 vendor-advisory
- SUSE-SU-2016:0756 vendor-advisory
- https://bto.bluecoat.com/security-advisory/sa112
- USN-2872-2 vendor-advisory
- DSA-3448 vendor-advisory
- https://security.netapp.com/advisory/ntap-20160211-0001/
- RHSA-2016:0064 vendor-advisory
- HPSBHF03436 vendor-advisory
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05130958
- SUSE-SU-2016:0752 vendor-advisory
- SUSE-SU-2016:0341 vendor-advisory
- [oss-security] 20160119 Linux kernel: use after free in keyring facility. mailing-list