What’s Vulnerable › Vulnerabilities

CVE-2018-16884

• Severity: high (CVSS 8.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-12-18 · updated 2026-06-17
• Weakness: CWE-416

Description

A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04
• Debian Linux: 8.0
• Linux kernel: from 3.7 before 3.16.65; from 3.17 before 3.18.133; from 3.19 before 4.4.171; from 4.5 before 4.9.151; from 4.10 before 4.14.94; from 4.15 before 4.19.16 — fixed in 3.16.65, 3.18.133, 4.14.94, 4.19.16, 4.20.3, 4.4.171
• Red Hat Enterprise Linux: 7.0
• RedHat Enterprise Mrg: 2.0

How to fix

Upgrade to a fixed version: Linux kernel 3.16.65, 3.18.133, 4.14.94, 4.19.16. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/106253
• https://access.redhat.com/errata/RHSA-2019:1873
• https://access.redhat.com/errata/RHSA-2019:1891
• https://access.redhat.com/errata/RHSA-2019:2696
• https://access.redhat.com/errata/RHSA-2019:2730
• https://access.redhat.com/errata/RHSA-2019:3309
• https://access.redhat.com/errata/RHSA-2019:3517
• https://access.redhat.com/errata/RHSA-2020:0204
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16884
• https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html
• https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html
• https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html

Get alerted when CVE-2018-16884 or the next vulnerability affects your stack