CVE-2016-10200

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-03-07 · updated 2026-06-17
Weakness: CWE-264

Description

Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c.

Affected products

Android: through 7.1.1
Linux kernel: from 3.0.34 before 3.2; from 3.2.20 before 3.2.88; from 3.4.2 before 3.12.69; from 3.13 before 3.16.40; from 3.17 before 3.18.52; from 3.19 before 4.4.38 — fixed in 3.12.69, 3.16.40, 3.18.52, 3.2, 3.2.88, 4.4.38

How to fix

Upgrade to a fixed version: Linux kernel 3.12.69, 3.16.40, 3.18.52, 3.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2016-10200 or the next vulnerability affects your stack