CVE-2016-7911

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-11-16 · updated 2026-06-17
Weakness: CWE-362

Description

Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel before 4.6.6 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call.

Affected products

Linux kernel: before 3.2.85; from 3.3 before 3.10.107; from 3.11 before 3.12.70; from 3.13 before 3.16.37; from 3.17 before 3.18.38; from 3.19 before 4.1.29 — fixed in 3.10.107, 3.12.70, 3.16.37, 3.18.38, 3.2.85, 4.1.29

How to fix

Upgrade to a fixed version: Linux kernel 3.10.107, 3.12.70, 3.16.37, 3.18.38. Check the vendor advisory for mitigations.

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8ba8682107ee2ca3347354e018865d8e1967c5f4
http://source.android.com/security/bulletin/2016-11-01.html
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.6
http://www.securityfocus.com/bid/94135
https://github.com/torvalds/linux/commit/8ba8682107ee2ca3347354e018865d8e1967c5f4
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8ba8682107ee2ca3347354e018865d8e1967c5f4
http://source.android.com/security/bulletin/2016-11-01.html
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.6
http://www.securityfocus.com/bid/94135
https://github.com/torvalds/linux/commit/8ba8682107ee2ca3347354e018865d8e1967c5f4

Get alerted when CVE-2016-7911 or the next vulnerability affects your stack