CVE-2016-9083

High

Published: 28/11/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The Linux kernel up to version 4.8.11 has a vulnerability that allows local users to bypass integer overflow checks, potentially leading to denial of service (memory corruption) or unspecified other impacts. This issue affects the ioctl call for a vfio PCI device file.

Risk Assessment

Organizations may face system crashes and potential data loss or other unforeseen consequences, impacting service availability.

Recommendation

It is recommended to update the Linux kernel to version 4.8.12 or later to mitigate this vulnerability and to monitor access to vfio PCI device files.

Other vulnerabilities in Linux kernel (do wersji 4.8.11)

CVE-2016-9084High
In the Linux kernel up to version 4.8.11, there is a flaw in the kzalloc function in vfio_pci_intrs.c that can lead to integer overflow, resulting in denial of service or unspecified other impacts. Local users can exploit access to a vfio PCI device file.

Original NVD description (English source)

drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local users to bypass integer overflow checks, and cause a denial of service (memory corruption) or have unspecified other impact, by leveraging access to a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call, aka a "state machine confusion bug."