CVE-2015-8660Linux Kernel Vulnerability
The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.
Published Dec 28, 2015 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2015-8660, UBUNTU-CVE-2015-8660, USN-2857-2, USN-2858-2
Key Facts
Routine patching- CVE-2015-8660 is a medium-severity vulnerability (CVSS 6.7 v3.1) affecting Linux Kernel, linux (debian), rootio-linux and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 22% probability of exploitation in the next 30 days.
- Fixed versions are available, including dtrace-modules-4.1.12-37.6.2.el6uek 0.5.2-1.el6, dtrace-modules-4.1.12-37.6.2.el7uek 0.5.2-1.el7, kernel 0:3.10.0-327.28.2.el7.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Scores
CVSS v3.1
6.7
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
22%
Higher than 97.6% of all scored CVEs
Exploit maturity
Weaponized
ATLAS score
53/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Weaponized
Public exploit code
4
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2015-8660
- advisoryhttps://ubuntu.com/security/CVE-2015-8660
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2015-8660
- advisoryhttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=acff81ec2c79492b180fade3c2894425cd35a545
- advisorySUSE-SU-2016:0751
- advisorySUSE-SU-2016:0752
Description
The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.
Affected Products
140 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Linux KernelLinux | See advisory | 3.18.31 |
| linuxdebian | See advisory | 4.3.3-3 |
| rootio-linuxrootio | See advisory | 4.3.3-3 |
| linux-lts-vividubuntu | See advisory | 3.19.0-43.49~14.04.1 |
| linux-lts-wilyubuntu | See advisory | 4.2.0-23.28~14.04.1 |
Patched Releases
dtrace-modules-4.1.12-37.6.2.el6uek
0.5.2-1.el6
dtrace-modules-4.1.12-37.6.2.el7uek
0.5.2-1.el7
kernel
0:3.10.0-327.28.2.el7, 3.10.0-327.28.2.el7
kernel-abi-whitelists
3.10.0-327.28.2.el7
kernel-debug
3.10.0-327.28.2.el7, 4.8.13-1.1
kernel-debug-base
4.8.13-1.1
kernel-debug-devel
3.10.0-327.28.2.el7, 4.8.13-1.1
kernel-default
3.12.53-60.30.1, 4.8.13-1.1
kernel-default-base
3.12.53-60.30.1, 4.8.13-1.1
kernel-default-devel
3.12.53-60.30.1, 4.8.13-1.1
kernel-default-extra
3.12.53-60.30.1
kernel-default-man
3.12.53-60.30.1
kernel-devel
3.10.0-327.28.2.el7, 3.12.53-60.30.1, 4.8.13-1.1
kernel-doc
3.10.0-327.28.2.el7
kernel-docs
3.12.53-60.30.2, 4.8.13-1.1
kernel-docs-html
4.8.13-1.1
kernel-docs-pdf
4.8.13-1.1
kernel-ec2
3.12.53-60.30.1
kernel-headers
3.10.0-327.28.2.el7
kernel-macros
3.12.53-60.30.1, 4.8.13-1.1
kernel-obs-build
3.12.53-60.30.2, 4.8.13-1.1
kernel-obs-qa
4.8.13-1.1
kernel-pae
4.8.13-1.1
kernel-pae-base
4.8.13-1.1
kernel-pae-devel
4.8.13-1.1
Timeline
Publicly disclosed
Dec 28, 2015
Last updated
Aug 4, 2026
Weakness Type
- CWE-264
- CWE-732 Incorrect Permission Assignment for Critical Resource
References
- advisorysecurity-tracker.debian.org · CVE-2015-8660
- advisoryubuntu.com · CVE-2015-8660
- advisorycve.org · CVERecord
- advisorygit.kernel.org · commit
- advisorySUSE-SU-2016:0751
FAQ
Common Questions.
The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.
Affected: Linux Kernel; linux (debian); rootio-linux, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including dtrace-modules-4.1.12-37.6.2.el6uek 0.5.2-1.el6, dtrace-modules-4.1.12-37.6.2.el7uek 0.5.2-1.el7, kernel 0:3.10.0-327.28.2.el7.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2015-8660 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo