CVE-2016-6786
published 2016-12-28CVE-2016-6786: kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain…
PriorityP430high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.42%
34.3th percentile
kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 30955111.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.0.2-1 (bookworm) | linux 4.0.2-1 (bookworm) |
| debian | linux | < linux 4.9.10-1 (bookworm) | linux 4.9.10-1 (bookworm) |
| android | — | — | |
| linux | linux_kernel | < 3.2.85 | 3.2.85 |
| linux | linux_kernel | >= 0 < 4.0.2-1 | 4.0.2-1 |
| linux | linux_kernel | >= 0 < 4.9.10-1 | 4.9.10-1 |
| linux | linux_kernel | >= 0 < 4.0.2-1 | 4.0.2-1 |
| linux | linux_kernel | >= 0 < 4.9.10-1 | 4.9.10-1 |
| linux | linux_kernel | >= 0 < 4.0.2-1 | 4.0.2-1 |
| linux | linux_kernel | >= 0 < 4.9.10-1 | 4.9.10-1 |
| linux | linux_kernel | >= 0 < 4.0.2-1 | 4.0.2-1 |
| linux | linux_kernel | >= 0 < 4.9.10-1 | 4.9.10-1 |
| linux | linux_kernel | >= 3.17 < 3.18.54 | 3.18.54 |
| linux | linux_kernel | >= 3.18.54 < 3.18.92 | 3.18.92 |
| linux | linux_kernel | >= 3.19 < 4.0 | 4.0 |
| linux | linux_kernel | >= 3.3 < 3.16.40 | 3.16.40 |
| linux | linux_kernel | >= 4.0 < 4.4.65 | 4.4.65 |
| linux | linux_kernel | >= 4.5 < 4.9.7 | 4.9.7 |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv7.0HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: Race condition between multiple sys_perf_event_open() calls
vendor_redhat·2017-01-14·CVSS 7.0
CVE-2017-6001 [HIGH] CWE-362 kernel: Race condition between multiple sys_perf_event_open() calls
kernel: Race condition between multiple sys_perf_event_open() calls
Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent perf_event_open system calls for moving a software group into a hardware context. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6786.
It was found that the original fix for CVE-2016-6786 was incomplete. There exist a race between two concurrent sys_perf_event_open() calls when both try and move the same pre-existing software group into a hardware context.
Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the perf subsystem where the flaw was found is not present in this product.
Debian
CVE-2017-6001: linux - Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows l...
vendor_debian·2017·CVSS 7.0
CVE-2017-6001 [HIGH] CVE-2017-6001: linux - Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows l...
Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent perf_event_open system calls for moving a software group into a hardware context. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6786.
Scope: local
bookworm: resolved (fixed in 4.9.10-1)
bullseye: resolved (fixed in 4.9.10-1)
forky: resolved (fixed in 4.9.10-1)
sid: resolved (fixed in 4.9.10-1)
trixie: resolved (fixed in 4.9.10-1)
Android
CVE-2016-6786: Android Security Bulletin 2016-12-01
CVE: CVE-2016-6786
Severity: HIGH
References: A-30955111
Upstream kernel
vendor_android·2016-12-01·CVSS 7.0
CVE-2016-6786 [HIGH] CVE-2016-6786: Android Security Bulletin 2016-12-01
CVE: CVE-2016-6786
Severity: HIGH
References: A-30955111
Upstream kernel
Android Security Bulletin 2016-12-01
CVE: CVE-2016-6786
Severity: HIGH
References: A-30955111
Upstream kernel
Debian
CVE-2016-6786: linux - kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0...
vendor_debian·2016·CVSS 7.0
CVE-2016-6786 [HIGH] CVE-2016-6786: linux - kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0...
kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 30955111.
Scope: local
bookworm: resolved (fixed in 4.0.2-1)
bullseye: resolved (fixed in 4.0.2-1)
forky: resolved (fixed in 4.0.2-1)
sid: resolved (fixed in 4.0.2-1)
trixie: resolved (fixed in 4.0.2-1)
Red Hat
kernel: Possible privilege escalation due to lack of locking around changing event->ctx
vendor_redhat·2015-02-04·CVSS 7.0
CVE-2016-6786 [HIGH] CWE-667 kernel: Possible privilege escalation due to lack of locking around changing event->ctx
kernel: Possible privilege escalation due to lack of locking around changing event->ctx
kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 30955111.
Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG-2 as the flaw was already fixed in the products listed.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: realtime-kernel (Red Hat E
GHSA
GHSA-8w4w-cch9-ch4c: kernel/events/core
ghsa_unreviewed·2022-05-17
CVE-2016-6786 [HIGH] GHSA-8w4w-cch9-ch4c: kernel/events/core
kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 30955111.
GHSA
GHSA-w3wx-x8m4-p4qj: Race condition in kernel/events/core
ghsa_unreviewed·2022-05-14·CVSS 7.0
CVE-2017-6001 [HIGH] CWE-362 GHSA-w3wx-x8m4-p4qj: Race condition in kernel/events/core
Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent perf_event_open system calls for moving a software group into a hardware context. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6786.
OSV
CVE-2017-6001: Race condition in kernel/events/core
osv·2017-02-18·CVSS 7.0
CVE-2017-6001 [HIGH] CVE-2017-6001: Race condition in kernel/events/core
Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent perf_event_open system calls for moving a software group into a hardware context. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6786.
OSV
CVE-2016-6786: kernel/events/core
osv·2016-12-28·CVSS 7.0
CVE-2016-6786 [HIGH] CVE-2016-6786: kernel/events/core
kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 30955111.
No detection rules found.
No public exploits indexed.
arXiv
Characteristics, Root Causes, and Detection of Incomplete Security Bug Fixes in the Linux Kernel
arxiv_fulltext·2025-11-21
Characteristics, Root Causes, and Detection of Incomplete Security Bug Fixes in the Linux Kernel
Characteristics, Root Causes, and Detection of
Incomplete Security Bug Fixes in the Linux Kernel
Qiang Liu^1All work was done by Aug., 2022.,
Wenlong Zhang^1,
Muhui Jiang^2,1,
Lei Wu^1,
Yajin Zhou^1
^1Zhejiang University,
^2The Hong Kong Polytechnic University
## Abstract
Security bugs in the Linux kernel emerge endlessly and have attracted much
attention.
However, fixing security bugs in the Linux kernel could be incomplete due to
human mistakes.
Specifically, an incomplete fix fails to repair all the original security
defects in the software, fails to properly repair the original security defects,
or introduces new ones.
In this paper, we study the fixes of incomplete security bugs in the Linux
kernel for the first time, and reveal their characteristics, root causes as well
as de
Bugzilla
CVE-2017-6001 kernel: Race condition between multiple sys_perf_event_open() calls
bugzilla·2017-02-16·CVSS 7.0
CVE-2017-6001 [HIGH] CVE-2017-6001 kernel: Race condition between multiple sys_perf_event_open() calls
CVE-2017-6001 kernel: Race condition between multiple sys_perf_event_open() calls
It was found that the original fix for CVE-2016-6786 was incomplete. There exist a race between two concurrent sys_perf_event_open() calls when both try and move the same pre-existing software group into a hardware context.
References:
https://marc.info/?l=linux-kernel&m=148370849716035
http://seclists.org/oss-sec/2017/q1/446
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=321027c1fe77f892f4ea07846aeae08cefbbb290
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1422827]
---
This was fixed in the 4.9.7 stable update available to all Fedora releases.
---
Statement:
This issue does not affect the Linux kernel packages as shi
Bugzilla
CVE-2016-6786 CVE-2016-6787 kernel: Possible privilege escalation due to lack of locking around changing event->ctx
bugzilla·2016-12-12·CVSS 7.0
CVE-2016-6786 [HIGH] CVE-2016-6786 CVE-2016-6787 kernel: Possible privilege escalation due to lack of locking around changing event->ctx
CVE-2016-6786 CVE-2016-6787 kernel: Possible privilege escalation due to lack of locking around changing event->ctx
Possible privilege escalation issue due to lack of mutex locking around places where perf_event::ctx is being changed.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f63a8daa5812afef4f06c962351687e1ff9ccb2b
Discussion:
Statement:
This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG-2 as the flaw was already fixed in the products listed.
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f63a8daa5812afef4f06c962351687e1ff9ccb2bhttp://source.android.com/security/bulletin/2016-12-01.htmlhttp://www.debian.org/security/2017/dsa-3791http://www.securityfocus.com/bid/94679https://bugzilla.redhat.com/show_bug.cgi?id=1403842https://github.com/torvalds/linux/commit/f63a8daa5812afef4f06c962351687e1ff9ccb2bhttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f63a8daa5812afef4f06c962351687e1ff9ccb2bhttp://source.android.com/security/bulletin/2016-12-01.htmlhttp://www.debian.org/security/2017/dsa-3791http://www.securityfocus.com/bid/94679https://bugzilla.redhat.com/show_bug.cgi?id=1403842https://github.com/torvalds/linux/commit/f63a8daa5812afef4f06c962351687e1ff9ccb2b
2016-12-28
Published