CVE-2018-5390: Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 71.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-06 · updated 2026-06-17
Weakness: CWE-400

Description

Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.

Affected products

A10Networks Advanced Core Operating System: 3.2.2, 3.2.2-p5, 4.1.0, 4.1.0-p11, 4.1.1-p8, 4.1.2 (+3)
Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04
Cisco Collaboration Meeting Rooms: 1.0
Cisco Digital Network Architecture Center: 1.2
Cisco Expressway: x8.10, x8.10.1, x8.10.2, x8.10.3, x8.10.4, x8.11
Cisco Expressway Series: all versions
Cisco Meeting Management: 1.0, 1.0.1
Cisco Network Assurance Engine: 2.1(1a)
Cisco Telepresence Conductor Firmware: xc4.3, xc4.3.1, xc4.3.2, xc4.3.3, xc4.3.4
Cisco Telepresence Video Communication Server Firmware: x8.10, x8.10.1, x8.10.2, x8.10.3, x8.10.4, x8.11
Cisco Threat Grid-Cloud: all versions
Cisco Webex Hybrid Data Security: all versions
Cisco Webex Video Mesh: all versions
Debian Linux: 8.0, 9.0
F5 BIG-IP APM: from 11.5.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.1.1; 14.0.0
BIG-IP: from 11.5.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.1.1; 14.0.0
F5 Big-Ip Analytics: from 11.5.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.1.1; 14.0.0
F5 Networks, Inc. BIG-IP (AAM): from 11.5.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.1.1; 14.0.0
BIG-IP ASM: from 11.5.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.1.1; 14.0.0
F5 BIG-IP DNS: from 11.5.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.1.1; 14.0.0
F5 Big-Ip Edge Gateway: from 11.5.1. through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.1.1; 14.0.0
F5 Big-Ip Fraud Protection Service: from 11.5.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.1.1; 14.0.0
F5 Big-Ip Global Traffic Manager: from 11.5.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.1.1; 14.0.0
F5 Big-Ip Link Controller: from 11.5.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.1.1; 14.0.0
F5 BIG-IP (LTM): from 11.5.1 through 11.6.3; from 12.0.0 through 12.1.3; from 13.0.0 (excl.) through 13.1.1; 14.0.0
F5 Networks, Inc. BIG-IP (PEM): from 11.5.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.1.1; 14.0.0
F5 Big-Ip Webaccelerator: from 11.5.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.1.1; 14.0.0
F5 Traffix Systems Signaling Delivery Controller: from 5.0.0 through 5.1.0; 4.4.0
HP Aruba Airwave Amp: before 8.2.7.1 — fixed in 8.2.7.1
Hewlett Packard Enterprise Aruba ClearPass Policy Manager: from 6.6.0 through 6.6.9; from 6.7.0 through 6.7.5

How to fix

Upgrade to a fixed version: HP Aruba Airwave Amp 8.2.7.1; Linux kernel 4.18. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-5390 or the next vulnerability affects your stack