Description
The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table, which allows local users to obtain root access on non-SMEP platforms via a crafted application. NOTE: this vulnerability exists because of incorrect backporting of the CVE-2016-9178 patch to older kernels.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux | 4.4.0-51.72 | USN-3146-1 |
| Ubuntu 16.04 LTS | linux-snapdragon | 4.4.0-1042.46 | USN-3161-4 |
| Ubuntu 14.04 LTS | linux | 3.13.0-145.194 | — |
| Ubuntu 14.04 LTS | linux-lts-xenial | 4.4.0-51.72~14.04.1 | USN-3146-2 |
Advisories 3
- USN-3146-1 linux vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-3161-4 linux-snapdragon vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-3146-2 linux-lts-xenial vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
References
- USN-3146-2 vendor-advisory
- 94545 vdb-entry
- USN-3146-1 vendor-advisory
- [oss-security] 20161107 Re: Re: kernel: fix minor infoleak in get_user_ex() mailing-list
- https://lwn.net/Articles/705220/