Description
Use-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 4.6.2-2 | — |
| Debian 13 | linux | 4.6.2-2 | — |
| Debian 12 | linux | 4.6.2-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux | 4.4.0-34.53 | USN-3055-1 |
| Ubuntu 16.04 LTS | linux-raspi2 | 4.4.0-1019.25 | USN-3056-1 |
| Ubuntu 16.04 LTS | linux-snapdragon | 4.4.0-1022.25 | USN-3057-1 |
| Ubuntu 14.04 LTS | linux-lts-vivid | 3.19.0-66.74~14.04.1 | USN-3053-1 |
| Ubuntu 14.04 LTS | linux-lts-xenial | 4.4.0-34.53~14.04.1 | USN-3054-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | kernel-rt +10 | 3.10.0-514.rt56.420.el7 | RHSA-2016:2584 |
| RHEL 7 | perf +18 | 3.10.0-514.el7 | RHSA-2016:2574 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | dtrace-modules-4.1.12-61.1.19.el6uek | 0.5.3-2.el6 | ELSA-2016-3644 |
| Oracle Linux 7 | dtrace-modules-4.1.12-61.1.19.el7uek | 0.5.3-2.el7 | ELSA-2016-3644 |
| Oracle Linux 7 | kernel-uek +5 | 4.1.12-61.1.19.el7uek | ELSA-2016-3644 |
| Oracle Linux 7 | perf +11 | 3.10.0-514.el7 | ELSA-2016-2574 |
Advisories 9
- RHSA-2016:2584 Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:2574 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-3055-1 linux vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-3053-1 linux-lts-vivid vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-3054-1 linux-lts-xenial vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-3056-1 linux-raspi2 vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-3057-1 linux-snapdragon vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- ELSA-2016-3644 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 20, 2016
- ELSA-2016-2574 Important: kernel security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 9, 2016
References
- USN-3054-1 vendor-advisory
- https://source.android.com/security/bulletin/2016-12-01.html
- USN-3053-1 vendor-advisory
- USN-3055-1 vendor-advisory
- USN-3056-1 vendor-advisory
- [oss-security] 20160512 Linux Kernel bpf related UAF mailing-list
- RHSA-2016:2584 vendor-advisory
- RHSA-2016:2574 vendor-advisory
- [linux-kernel] 20160417 Re: bpf: use-after-free in array_map_alloc mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=1335889
- USN-3057-1 vendor-advisory
- 90625 vdb-entry