Description
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 4.8.15-1 | — |
| Debian 13 | linux | 4.8.15-1 | — |
| Debian 12 | linux | 4.8.15-1 | — |
| Debian 7 | linux | 3.2.84-1 | DLA-772-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux | 4.4.0-53.74 | USN-3151-1 |
| Ubuntu 16.04 LTS | linux-raspi2 | 4.4.0-1034.41 | USN-3151-4 |
| Ubuntu 16.04 LTS | linux-snapdragon | 4.4.0-1039.43 | USN-3151-3 |
| Ubuntu 14.04 LTS | linux | 3.13.0-105.152 | USN-3149-1 |
| Ubuntu 14.04 LTS | linux-lts-vivid | 3.19.0-77.85~14.04.1 | — |
| Ubuntu 14.04 LTS | linux-lts-xenial | 4.4.0-53.74~14.04.1 | USN-3151-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | kernel-rt +10 | 3.10.0-514.10.2.rt56.435.el7 | RHSA-2017:0387 |
| RHEL 7 | perf +18 | 3.10.0-514.10.2.el7 | RHSA-2017:0386 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | kernel-rt +10 | 1:3.10.0-514.rt56.215.el6rt | RHSA-2017:0402 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | kernel-docs | 4.4.21-84.3 | SUSE-SU-2016:3049-1 |
| SLES 12 SP2 | kernel-syms +3 | 4.4.21-84.1 | SUSE-SU-2016:3049-1 |
| SLES 12 SP1 | kernel-docs | 3.12.67-60.64.21.3 | SUSE-SU-2016:3039-1 |
| SLES 12 SP1 | kernel-xen +4 | 3.12.67-60.64.21.1 | SUSE-SU-2016:3039-1 |
| SLES 12 | kernel-ec2 +4 | 3.12.60-52.60.1 | SUSE-SU-2016:3063-1, SUSE-SU-2016:3039-1 |
| SLES 12 | kgraft-patch-SLE12_Update_11 | 6-2.1 | SUSE-SU-2016:3119-1 |
| SLES 12 | kgraft-patch-SLE12_Update_12 +3 | 4-2.1 | SUSE-SU-2016:3197-1, SUSE-SU-2016:3113-1, SUSE-SU-2016:3112-1 |
| SLES 12 | kgraft-patch-SLE12_Update_16 | 2-2.1 | SUSE-SU-2016:3247-1 |
| SLES 12 | kgraft-patch-SLE12_Update_17 | 1-2.1 | SUSE-SU-2016:3063-1 |
| SLES 12 | kgraft-patch-SLE12_Update_9 +1 | 7-2.1 | SUSE-SU-2016:3249-1, SUSE-SU-2016:3111-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP2 | kernel-syms +2 | 4.4.21-84.1 | SUSE-SU-2016:3049-1 |
| SLES for SAP 12 SP1 | kernel-xen +3 | 3.12.67-60.64.21.1 | SUSE-SU-2016:3039-1 |
| SLES for SAP 12 | kernel-xen +3 | 3.12.60-52.60.1 | SUSE-SU-2016:3063-1 |
| SLES for SAP 12 | kgraft-patch-SLE12_Update_11 | 6-2.1 | SUSE-SU-2016:3119-1 |
| SLES for SAP 12 | kgraft-patch-SLE12_Update_12 +3 | 4-2.1 | SUSE-SU-2016:3197-1, SUSE-SU-2016:3113-1, SUSE-SU-2016:3112-1 |
| SLES for SAP 12 | kgraft-patch-SLE12_Update_16 | 2-2.1 | SUSE-SU-2016:3247-1 |
| SLES for SAP 12 | kgraft-patch-SLE12_Update_17 | 1-2.1 | SUSE-SU-2016:3063-1 |
| SLES for SAP 12 | kgraft-patch-SLE12_Update_9 +1 | 7-2.1 | SUSE-SU-2016:3249-1, SUSE-SU-2016:3111-1 |
| SLE Real Time 12 SP1 | kernel-rt +5 | 3.12.69-60.30.1 | SUSE-SU-2017:0407-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12-SP1_Update_0 | 8-23.2 | SUSE-SU-2016:3094-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12-SP1_Update_1 | 8-2.1 | SUSE-SU-2016:3100-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12-SP1_Update_2 | 7-2.1 | SUSE-SU-2016:3093-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12-SP1_Update_3 | 6-2.1 | SUSE-SU-2016:3098-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12-SP1_Update_4 +2 | 5-2.1 | SUSE-SU-2016:3117-1, SUSE-SU-2016:3104-1, SUSE-SU-2016:3096-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12-SP1_Update_7 | 4-2.1 | SUSE-SU-2016:3183-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12-SP1_Update_8 | 3-2.1 | SUSE-SU-2016:3116-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12-SP1_Update_9 +1 | 2-2.1 | SUSE-SU-2016:3206-1, SUSE-SU-2016:3205-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12-SP2_Update_0 | 2-5.1 | SUSE-SU-2016:3169-1 |
| SLE Live Patching 12 | kgraft-patch-SLE12-SP2_Update_2 +1 | 1-2.1 | SUSE-SU-2016:3049-1, SUSE-SU-2016:3039-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | dtrace-modules-3.8.13-118.16.2.el6uek | 0.4.5-3.el6 | ELSA-2017-3509 |
| Oracle Linux 7 | dtrace-modules-3.8.13-118.16.2.el7uek | 0.4.5-3.el7 | ELSA-2017-3509 |
| Oracle Linux 7 | dtrace-modules-4.1.12-61.1.25.el6uek | 0.5.3-2.el6 | ELSA-2017-3508 |
| Oracle Linux 7 | dtrace-modules-4.1.12-61.1.25.el7uek | 0.5.3-2.el7 | ELSA-2017-3508 |
| Oracle Linux 7 | kernel-uek +5 | 3.8.13-118.16.2.el7uek | ELSA-2017-3509, ELSA-2017-3508 |
| Oracle Linux 7 | perf +11 | 3.10.0-514.10.2.el7 | ELSA-2017-0386 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
AF_PACKET chocobo_root Privilege Escalation
exploit/linux/local/af_packet_chocobo_root_priv_esc
Exploit-DB 3
- Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x64) - 'AF_PACKET' Race Condition Privilege Escalation EDB-47170 · local · Dec 29, 2018
- Linux 4.4.0 < 4.4.0-53 - 'AF_PACKET chocobo_root' Local Privilege Escalation (Metasploit) EDB-44696 · local · May 22, 2018 · verified
- Linux Kernel 4.4.0 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation EDB-40871 · local · Dec 6, 2016 · verified
GitHub 6 repositories
-
martinmullins/CVE-2016-8655_Android ★ 12 · Dec 17, 2016
Android attempt at PoC CVE-2016-8655
-
LakshmiDesai/CVE-2016-8655 ★ 5 · Dec 8, 2016
-
WhatsWrongAndWhy/CVE-2016-8655 ★ 0 · Jul 15, 2026
-
agkunkle/chocobo ★ 0 · Dec 9, 2016
Chocobo Root (CVE-2016-8655) Analysis
-
KosukeShimofuji/CVE-2016-8655 ★ 0 · Dec 9, 2016
Linux af_packet.c race condition (local root)
-
scarvell/cve-2016-8655 ★ 0 · Dec 7, 2016
PoC for CVE-2016-8655 that causes a kernel panic
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 36
- RHSA-2017:0402 Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:0387 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:0386 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-3149-1 linux vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-3151-1 linux vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-772-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3151-2 linux-lts-xenial vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-3151-3 linux-snapdragon vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-3151-4 linux-raspi2 vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2016:3249-1 Security update for Linux Kernel Live Patch 10 for SLE 12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3098-1 Security update for Linux Kernel Live Patch 3 for SLE 12 SP1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3119-1 Security update for Linux Kernel Live Patch 11 for SLE 12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3197-1 Security update for Linux Kernel Live Patch 15 for SLE 12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3093-1 Security update for Linux Kernel Live Patch 2 for SLE 12 SP1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3169-1 Security update for Linux Kernel Live Patch 0 for SLE 12 SP2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3117-1 Security update for Linux Kernel Live Patch 5 for SLE 12 SP1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3205-1 Security update for Linux Kernel Live Patch 9 for SLE 12 SP1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3206-1 Security update for Linux Kernel Live Patch 1 for SLE 12 SP2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3112-1 Security update for Linux Kernel Live Patch 12 for SLE 12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3104-1 Security update for Linux Kernel Live Patch 4 for SLE 12 SP1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0407-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3094-1 Security update for Linux Kernel Live Patch 0 for SLE 12 SP1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3247-1 Security update for Linux Kernel Live Patch 16 for SLE 12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3063-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3039-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3100-1 Security update for Linux Kernel Live Patch 1 for SLE 12 SP1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3049-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3111-1 Security update for Linux Kernel Live Patch 9 for SLE 12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3116-1 Security update for Linux Kernel Live Patch 8 for SLE 12 SP1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:3183-1 Security update for Linux Kernel Live Patch 7 for SLE 12 SP1 SUSE / openSUSE Security Updates · May 2, 2025
- SUSE-SU-2016:3113-1 Security update for Linux Kernel Live Patch 14 for SLE 12 SUSE / openSUSE Security Updates · May 2, 2025
- SUSE-SU-2016:3096-1 Security update for Linux Kernel Live Patch 6 for SLE 12 SP1 SUSE / openSUSE Security Updates · May 2, 2025
- SUSE-SU-2016:3109-1 Security update for Linux Kernel Live Patch 13 for SLE 12 SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2017-0386 Important: kernel security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 2, 2017
- ELSA-2017-3509 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 12, 2017
- ELSA-2017-3508 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 12, 2017
References
- USN-3151-3 vendor-advisory
- SUSE-SU-2016:3096 vendor-advisory
- https://github.com/torvalds/linux/commit/84ac7260236a49c79eede91617700174c2c19b0c
- SUSE-SU-2016:3206 vendor-advisory
- SUSE-SU-2016:3169 vendor-advisory
- USN-3150-2 vendor-advisory
- USN-3149-2 vendor-advisory
- 94692 vdb-entry
- 1037968 vdb-entry
- USN-3150-1 vendor-advisory
- SUSE-SU-2016:3117 vendor-advisory
- SUSE-SU-2016:3197 vendor-advisory
- RHSA-2017:0402 vendor-advisory
- USN-3151-1 vendor-advisory
- RHSA-2017:0387 vendor-advisory
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede91617700174c2c19b0c
- 40871 exploit
- USN-3149-1 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1400019
- 44696 exploit
- SUSE-SU-2016:3247 vendor-advisory
- USN-3151-2 vendor-advisory
- SUSE-SU-2016:3183 vendor-advisory
- http://packetstormsecurity.com/files/140063/Linux-Kernel-4.4.0-AF_PACKET-Race-Condition-Privilege-Escalation.html
- [oss-security] 20161206 CVE-2016-8655 Linux af_packet.c race condition (local root) mailing-list
- USN-3152-1 vendor-advisory
- USN-3152-2 vendor-advisory
- RHSA-2017:0386 vendor-advisory
- 1037403 vdb-entry
- USN-3151-4 vendor-advisory
- SUSE-SU-2016:3116 vendor-advisory
- SUSE-SU-2016:3113 vendor-advisory
- https://source.android.com/security/bulletin/2017-03-01.html
- SUSE-SU-2016:3205 vendor-advisory