CVE-2017-5986: linux linux_kernel
Vulnerability summary
CVE-2017-5986 is a high (CVSS 7.1) vulnerability in linux linux_kernel. EPSS estimates a 1.16% chance of exploitation in the next 30 days, higher than 67.2% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 15 · Related 9Timeline
- 18-02-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (assertion failure and panic) via a multithreaded application that peels off an association in a certain buffer-full state.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.16%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.16% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
- CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Affected systems
Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu21 products
- linux< 3.13.0-117.164 | < 4.4.0-75.96
- linux-aws< 4.4.0-1016.25
- linux-azureAll versions (No fix recorded)
- linux-azure-6.11All versions (No fix recorded)
- linux-azure-fdeAll versions (No fix recorded)
Debian1 product
- linux< 4.9.10-1
Linux1 product
- linux_kernel≤ 4.9.11
3 vendors · 23 products
References
17 links- github.com/torvalds/linux/commit/2dcab598484185dea7ec22219c76dcdd59e3cb90X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2017/02/14/6Mailing ListX Refsource MLISTPatchThird Party Advisory
- www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.11X Refsource CONFIRMRelease NotesVendor Advisory