CVE-2016-8650: linux linux_kernel Improper Input Validation
Vulnerability summary
CVE-2016-8650 is a medium (CVSS 5.5) Improper Input Validation vulnerability in linux linux_kernel. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.9% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 8 · Related 1Timeline
- 28-11-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which allows local users to cause a denial of service (stack memory corruption and panic) via an add_key system call for an RSA key with a zero exponent.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.41% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-399Resource Management ErrorsWeaknesses in this category are related to improper management of system resources.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu6 products
- linux< 3.13.0-132.181 | < 4.4.0-62.83
- linux-aws< 4.4.0-1003.12
- linux-hwe< 4.8.0-39.42~16.04.1
- linux-lts-xenial< 4.4.0-62.83~14.04.1
- linux-raspi2< 4.4.0-1042.49
Debian1 product
- linux< 4.8.11-1
Linux1 product
- linux_kernel≤ 4.8.11
3 vendors · 8 products
References
17 links- github.com/torvalds/linux/commit/f5527fffff3f002b0a6b376163613b82f69de073X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
Show all 17 references
- source.android.com/security/bulletin/2017-03-01.htmlX Refsource CONFIRM
