VYPR
← All advisories
High severity7.8NVD Advisory· Published Oct 19, 2017· Updated May 13, 2026

CVE-2017-15649

CVE-2017-15649

Description

net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A race condition in the Linux kernel's packet fanout implementation (before 4.13.6) allows local users to gain privileges via a use-after-free bug.

Vulnerability

CVE-2017-15649 is a race condition vulnerability in the Linux kernel's net/packet/af_packet.c file, specifically in the fanout_add and packet_do_bind functions. The bug affects kernels before version 4.13.6 [1][4]. It involves mishandling of packet_fanout data structures and is distinct from CVE-2017-6346.

Exploitation

An attacker with local access to the system can trigger the vulnerability by crafting a sequence of system calls that exploits a race window between fanout_add and packet_do_bind. This race condition leads to a use-after-free scenario [1][3][4]. No special privileges beyond local user access are required.

Impact

Successful exploitation allows an attacker to escalate privileges on the affected system. The impact can range from denial of service (system crash) to arbitrary code execution with elevated privileges [1][3][4]. Confidentiality, integrity, and availability of the system may be compromised.

Mitigation

Red Hat released updated kernel packages (kernel-3.10.0-693.17.1.el7) in RHSA-2018:0151 and RHSA-2018:0152 for Red Hat Enterprise Linux 7 [1][2]. An updated kernel-rt package was provided in RHSA-2018:0181 for Red Hat MRG [4]. Ubuntu published kernel updates in USN-3754-1 [3]. Users should apply the latest updates for their distribution. The upstream fix is included in Linux kernel version 4.13.6 and later.

References
  1. https://access.redhat.com/errata/RHSA-2018:0151
  2. https://access.redhat.com/errata/RHSA-2018:0152
  3. USN-3754-1: Linux kernel vulnerabilities | Ubuntu security notices | Ubuntu
  4. https://access.redhat.com/errata/RHSA-2018:0181

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

113

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

14

News mentions

0

No linked articles in our index yet.