Unscored CVE-2016-9120 EUVD-2016-9940GHSA-m72g-wmm2-j9fv

Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain pri…

Published Dec 8, 2016 · Updated Aug 6, 2024 · Assigned by google_android

Package: linux Package: linux-azure Package: linux-azure-fde Package: linux-gcp Package: linux-gke Package: linux-hwe Package: linux-intel-iot-realtime Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Ecosystem: Debian Ecosystem: Ubuntu

Description

Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	linux	4.6.1-1	—
Debian 13	linux	4.6.1-1	—
Debian 12	linux	4.6.1-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 24.04 LTS	linux-raspi-realtime	No fix yet	—
Ubuntu 22.04 LTS	linux-riscv +2	No fix yet	—
Ubuntu 20.04 LTS	linux-gke +3	No fix yet	—
Ubuntu 18.04 LTS	linux-gcp +2	No fix yet	—

References