CVE-2017-8797: linux linux_kernel Improper Validation of Array Index
Vulnerability summary
CVE-2017-8797 is a high (CVSS 7.8) Improper Validation of Array Index vulnerability in linux linux_kernel. EPSS estimates a 9.48% chance of exploitation in the next 30 days, higher than 95.4% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 9% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 14 · Related 10Timeline
- 02-07-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
9.48%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
No change 0.00 pp
From 9.48% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu13 products
- linux< 4.4.0-83.106
- linux-aws< 4.4.0-1022.31
- linux-azure-fdeAll versions (No fix recorded)
- linux-gcp< 4.13.0-1002.5
- linux-gkeAll versions (No fix recorded)
Debian1 product
- linux< 4.9.30-1
Linux1 product
- linux_kernel≥ 4.0, < 4.1.40 | ≥ 4.2, < 4.4.70 | ≥ 4.5, < 4.9.30 | ≥ 4.11, < 4.11.3
3 vendors · 15 products
References
16 links- github.com/torvalds/linux/commit/f961e3f2acae94b727380c0b74e2d3954d0edf79X Refsource MISCPatchThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1466329X Refsource MISCIssue TrackingThird Party AdvisoryVDB Entry
- github.com/torvalds/linux/commit/b550a32e60a4941994b437a8d662432a486235a5X Refsource MISCPatchThird Party Advisory
