CVE-2016-9754

🗓️ 05 Jan 2017 11:00:00Reported by google_androidType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 86 Views🌐 WEB

The ring_buffer_resize function in kernel/trace/ring_buffer.c mishandles integer calculations, allowing local users to gain privileges by writing to the /sys/kernel/debug/tracing/buffer_size_kb file

Reporter	Title	Published	Views	Family All 37
BDU FSTEC	The vulnerability of the ring_buffer_resize function in the Linux kernel’s profiling subsystem allows a hacker to increase their privileges.	14 Jul 201700:00	–	bdu_fstec
CNVD	Linux kernel local integer overflow vulnerability (CNVD-2017-00226)	6 Jan 201700:00	–	cnvd
Cvelist	CVE-2016-9754	5 Jan 201711:00	–	cvelist
Debian CVE	CVE-2016-9754	5 Jan 201711:00	–	debiancve
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1472)	13 May 201900:00	–	nessus
Tenable Nessus	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1498)	13 May 201900:00	–	nessus
Tenable Nessus	Photon OS 1.0: Libxml2 / Linux / Openssh PHSA-2017-0001 (deprecated)	17 Aug 201800:00	–	nessus
Tenable Nessus	Photon OS 1.0: Linux PHSA-2017-0001	7 Feb 201900:00	–	nessus
Tenable Nessus	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3422-1)	19 Sep 201700:00	–	nessus
Tenable Nessus	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000987)	14 Jan 202600:00	–	nessus

NVD

Node

linux linux_kernelRange3.5–3.10.102

linux linux_kernelRange3.11–3.12.61

linux linux_kernelRange3.13–3.14.71

linux linux_kernelRange3.15–3.16.37

linux linux_kernelRange3.17–3.18.35

linux linux_kernelRange3.19–4.1.26

linux linux_kernelRange4.2–4.4.12

linux linux_kernelRange4.5–4.5.6

linux linux_kernelMatch4.6

Source	Link
securityfocus	www.securityfocus.com/bid/95278
github	www.github.com/torvalds/linux/commit/59643d1535eb220668692a5359de22545af579f6
git	www.git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/
kernel	www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.1
source	www.source.android.com/security/bulletin/2017-01-01.html

Parameter	Position	Path	Description	CWE
buffer_size_kb	path	/sys/kernel/debug/tracing/buffer_size_kb	Local privilege escalation by writing to /sys/kernel/debug/tracing/buffer_size_kb due to an integer calculation issue in ring_buffer_resize in the Linux kernel before 4.6.1.	CWE-190

17 Jun 2026 00:56Current

7.3High risk

Vulners AI Score7.3

CVSS 27.2

CVSS 3.17.8

EPSS0.00532

CWE-190