Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.0
CVE-2016-6786: Linux Kernel Performance Subsystem Lock Mismanagement Allows Privilege Escalation
CVE-2016-6786 · published 9 years ago
Summary
A flaw in the Linux kernel's performance subsystem could allow a local attacker to gain unauthorized access to system resources. This vulnerability affects Linux systems before version 4.0. To protect your system, update to a version of the Linux kernel that is 4.0 or later.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | linux | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| – | linux | linux_kernel |
< 3.2.85 >= 3.3, < 3.16.40 >= 3.17, < 3.18.54 >= 3.19, < 4.0 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
Original advisory text
kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, a...
kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 30955111.
References
- https://ubuntu.com/security/CVE-2016-6786 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2016-6786 Third Party Advisory
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f63a8d... Patch Vendor Advisory
- http://source.android.com/security/bulletin/2016-12-01.html Third Party Advisory
- http://www.debian.org/security/2017/dsa-3791 Third Party Advisory
- http://www.securityfocus.com/bid/94679 Third Party Advisory VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1403842 Issue Tracking Third Party Advisory
- https://github.com/torvalds/linux/commit/f63a8daa5812afef4f06c962351687e1ff9ccb2... Patch Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published28 Dec 2016
Updated4 Nov 2026
First seen18 Aug 2026
Track software like this
Free during beta