CVE-2016-10150

Critical

Published: 06/02/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A use-after-free vulnerability in the kvm_ioctl_create_device function in the Linux kernel before version 4.8.13 allows host OS users to cause a denial of service (host OS crash) or possibly gain privileges via crafted ioctl calls on the /dev/kvm device.

Risk Assessment

The organization may experience a host OS crash, leading to service availability interruptions. There is also a risk of unauthorized privilege escalation by an attacker.

Recommendation

It is recommended to update the Linux kernel to version 4.8.13 or later to mitigate this vulnerability.

Original NVD description (English source)

Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows host OS users to cause a denial of service (host OS crash) or possibly gain privileges via crafted ioctl calls on the /dev/kvm device.