Critical severity9.8NVD Advisory· Published Apr 4, 2017· Updated May 13, 2026

CVE-2016-10229

Description

udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSG_PEEK flag.

Affected products

Google/Android
cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
Range: <=7.1.1
Linux/Kernel
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Range: >=3.2,<3.2.76

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/nvdIssue TrackingPatchThird Party Advisory
source.android.com/security/bulletin/2017-04-01.htmlnvdPatchThird Party Advisory
github.com/torvalds/linux/commit/197c949e7798fbf28cfadc69d9ca0c2abbf93191nvdIssue TrackingPatchThird Party Advisory
www.securityfocus.com/bid/97397nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1038201nvdThird Party AdvisoryVDB Entry
security.paloaltonetworks.com/CVE-2016-10229nvdThird Party Advisory
security.netapp.com/advisory/ntap-20250103-0008/nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000