Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

Linux kernel key cleanup may crash system

CVE-2015-7872 · published 10 years ago
Summary

A function in the Linux kernel that removes unused security keys can be triggered by a local user with specially crafted key management commands, causing the kernel to crash (an OOPS). This can lead to a denial of service, making the machine temporarily unusable. Apply the latest kernel updates for the affected Linux releases or contact your vendor for a patched version.

What to do
  • Update canonical linux to version 3.13.0-70.113.
  • Update canonical linux-lts-utopic to version 3.16.0-55.74~14.04.1.
  • Update canonical linux-lts-vivid to version 3.19.0-37.42~14.04.1.
  • Update canonical linux-lts-wily to version 4.2.0-21.25~14.04.1.
  • Update debian linux to version 4.2.5-1.
Affected software
Ecosystem VendorProductAffected versions
Ubuntu:14.04:LTS canonical linux < 3.13.0-70.113
Fix: upgrade to 3.13.0-70.113
Ubuntu:14.04:LTS canonical linux-lts-utopic < 3.16.0-55.74~14.04.1
Fix: upgrade to 3.16.0-55.74~14.04.1
Ubuntu:14.04:LTS canonical linux-lts-vivid < 3.19.0-37.42~14.04.1
Fix: upgrade to 3.19.0-37.42~14.04.1
Ubuntu:14.04:LTS canonical linux-lts-wily < 4.2.0-21.25~14.04.1
Fix: upgrade to 4.2.0-21.25~14.04.1
Ubuntu:18.04:LTS canonical linux-azure All versions
Ubuntu:18.04:LTS canonical linux-gcp All versions
Ubuntu:18.04:LTS canonical linux-hwe All versions
Ubuntu:18.04:LTS canonical linux-hwe-edge All versions
Ubuntu:20.04:LTS canonical linux-azure-fde All versions
Ubuntu:Pro:20.04:LTS canonical linux-azure-fde-5.15 All versions
Ubuntu:20.04:LTS canonical linux-gke All versions
Ubuntu:20.04:LTS canonical linux-gkeop All versions
Ubuntu:20.04:LTS canonical linux-raspi2 All versions
Ubuntu:20.04:LTS canonical linux-riscv All versions
Ubuntu:22.04:LTS canonical linux-intel-iot-realtime All versions
Ubuntu:22.04:LTS canonical linux-realtime All versions
Ubuntu:22.04:LTS canonical linux-riscv All versions
Ubuntu:24.04:LTS canonical linux-azure-6.11 All versions
Ubuntu:24.04:LTS canonical linux-gcp-6.11 All versions
Ubuntu:24.04:LTS canonical linux-hwe-6.11 All versions
Ubuntu:24.04:LTS canonical linux-lowlatency-hwe-6.11 All versions
Ubuntu:24.04:LTS canonical linux-raspi-realtime All versions
Ubuntu:24.04:LTS canonical linux-realtime All versions
Ubuntu:24.04:LTS canonical linux-riscv All versions
Debian:12 debian linux < 4.2.5-1
Fix: upgrade to 4.2.5-1
Debian:13 debian linux < 4.2.5-1
Fix: upgrade to 4.2.5-1
Debian:14 debian linux < 4.2.5-1
Fix: upgrade to 4.2.5-1
– linux linux_kernel <= 4.2.6
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Original advisory text
The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service (OOPS) via crafted keyctl commands.
The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service (OOPS) via crafted keyctl commands.
References
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published16 Nov 2015
Updated4 Nov 2026
First seen12 May 2026
Sources
UBUNTU-CVE-2015-7872 · OSV
CVE-2015-7872 · NVD
DEBIAN-CVE-2015-7872 · OSV
Track software like this
Free during beta