CVE-2016-9084

High

Published: 28/11/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In the Linux kernel up to version 4.8.11, there is a flaw in the kzalloc function in vfio_pci_intrs.c that can lead to integer overflow, resulting in denial of service or unspecified other impacts. Local users can exploit access to a vfio PCI device file.

Risk Assessment

Organizations may be exposed to denial of service, affecting system availability and data security. Potential unspecified impacts could lead to further threats.

Recommendation

It is recommended to update the Linux kernel to a version that does not contain this vulnerability. Additionally, monitor access to vfio PCI device files.

Other vulnerabilities in Linux kernel (do wersji 4.8.11)

CVE-2016-9083High
The Linux kernel up to version 4.8.11 has a vulnerability that allows local users to bypass integer overflow checks, potentially leading to denial of service (memory corruption) or unspecified other impacts. This issue affects the ioctl call for a vfio PCI device file.

Original NVD description (English source)

drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11 misuses the kzalloc function, which allows local users to cause a denial of service (integer overflow) or have unspecified other impact by leveraging access to a vfio PCI device file.