CVE-2018-18559

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-10-22 · updated 2026-06-17
Weakness: CWE-362

Description

In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control.

Affected products

Linux kernel: from 3.2.95 before 3.2.100; from 3.14.58 before 3.15; from 3.18.25 before 3.18.88; from 4.1.14 before 4.1.49; from 4.2.7 before 4.3; from 4.3.1 before 4.4.106 — fixed in 3.15, 3.18.88, 3.2.100, 4.1.49, 4.14.7, 4.3
RedHat Enterprise Linux Desktop: 7.0
RedHat Enterprise Linux Server: 7.0
RedHat Enterprise Linux Server Aus: 7.6
RedHat Enterprise Linux Server Eus: 7.6
RedHat Enterprise Linux Server Tus: 7.6
RedHat Enterprise Linux Workstation: 7.0
Red Hat OpenShift Container Platform 4.18: 3.11
RedHat Virtualization Host: 4.0

How to fix

Upgrade to a fixed version: Linux kernel 3.15, 3.18.88, 3.2.100, 4.1.49. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-18559 or the next vulnerability affects your stack