CVE-2017-16995Linux Kernel Memory Corruption
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension.
Published Dec 27, 2017 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2017-16995, UBUNTU-CVE-2017-16995, UBUNTU-CVE-2017-17863, USN-3523-2, USN-3633-1
Key Facts
Patch immediately- CVE-2017-16995 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting Ubuntu Linux (Canonical), Debian Linux, Linux Kernel and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 30% probability of exploitation in the next 30 days.
- Fixed versions are available, including kernel-devel 5.14.6-1.4, kernel-devel-longterm 6.6.17-1.1, kernel-macros 5.14.6-1.4.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
30%
Higher than 98.1% of all scored CVEs
Exploit maturity
Weaponized
ATLAS score
59/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Weaponized
Public exploit code
4
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2017-16995
- advisoryhttps://ubuntu.com/security/CVE-2017-16995
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2017-16995
- advisoryhttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f
- advisoryhttp://openwall.com/lists/oss-security/2017/12/21/2
- advisoryhttps://bugs.chromium.org/p/project-zero/issues/detail?id=1454
Description
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension.
Affected Products
59 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Ubuntu LinuxCanonical | 14.04, 16.04 | n/a |
| Debian LinuxDebian | 9.0 | n/a |
| Linux KernelLinux | See advisory | 4.9.72 |
| linuxarch | See advisory | 4.14.11-1 |
| linux-hardenedarch | See advisory | 4.14.11.a-1 |
Patched Releases
kernel-devel
5.14.6-1.4
kernel-devel-longterm
6.6.17-1.1
kernel-macros
5.14.6-1.4
kernel-source
5.14.6-1.4
kernel-source-longterm
6.6.17-1.1
kernel-source-vanilla
5.14.6-1.4
linux
4.14.11-1, 4.14.7-1, 4.4.0-119.143, 4.9.65-3+deb9u1, 4.9.74-1.ph2, NA
Linux Kernel
4.9.72
linux-aws
4.4.0-1016.16, 4.4.0-1054.63, 4.9.89-1.ph2
linux-azure
4.13.0-1005.7
linux-esx
4.9.74-1.ph2, NA
linux-euclid
4.4.0-9026.28
linux-fips
4.4.0-1008.10
linux-gcp
4.13.0-1006.9
linux-hardened
4.14.11.a-1
linux-hwe
4.13.0-26.29~16.04.2, 4.13.0-32.35~16.04.1
linux-kvm
4.4.0-1020.25
linux-lts
4.9.74-1
linux-lts-xenial
4.4.0-119.143~14.04.1
linux-oem
4.13.0-1015.16
linux-raspi2
4.4.0-1086.94
linux-secure
4.9.74-1.ph2
linux-snapdragon
4.4.0-1088.93
linux-zen
4.14.11-1
rootio-linux
4.14.7-1
Timeline
Publicly disclosed
Dec 27, 2017
Last updated
Aug 4, 2026
Weakness Type
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-787 Out-of-bounds Write
References
- advisorysecurity-tracker.debian.org · CVE-2017-16995
- advisoryubuntu.com · CVE-2017-16995
- advisorycve.org · CVERecord
- advisorygit.kernel.org · commit
- advisoryopenwall.com · 2
FAQ
Common Questions.
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension.
Affected: Ubuntu Linux (Canonical) versions 14.04, 16.04; Debian Linux versions 9.0; Linux Kernel, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including kernel-devel 5.14.6-1.4, kernel-devel-longterm 6.6.17-1.1, kernel-macros 5.14.6-1.4.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2017-16995 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo