What’s Vulnerable › Vulnerabilities

CVE-2016-4951

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-05-23 · updated 2026-06-17

Description

The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket existence, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a dumpit operation.

Affected products

• Canonical Ubuntu Linux: 14.04, 15.10, 16.04
• Linux kernel: from 3.19 before 4.1.28; from 4.2 before 4.4.14; from 4.5 before 4.6.3 — fixed in 4.1.28, 4.4.14, 4.6.3
• Oracle Corporation Oracle Linux: 6

How to fix

Upgrade to a fixed version: Linux kernel 4.1.28, 4.4.14, 4.6.3. Check the vendor advisory for mitigations.

References

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=45e093ae2830cd1264677d47ff9a95a71f5d9f9c
• http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.html
• http://lists.openwall.net/netdev/2016/05/14/28
• http://www.openwall.com/lists/oss-security/2016/05/21/2
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
• http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
• http://www.ubuntu.com/usn/USN-3016-1
• http://www.ubuntu.com/usn/USN-3016-2
• http://www.ubuntu.com/usn/USN-3016-3
• http://www.ubuntu.com/usn/USN-3016-4
• http://www.ubuntu.com/usn/USN-3017-1
• http://www.ubuntu.com/usn/USN-3017-2

Get alerted when CVE-2016-4951 or the next vulnerability affects your stack