CVE-2018-1095: linux linux_kernel NULL Pointer Dereference
Vulnerability summary
CVE-2018-1095 is a high (CVSS 7.1) NULL Pointer Dereference vulnerability in linux linux_kernel. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 73% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 2Timeline
- 02-04-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The ext4_xattr_check_entries function in fs/ext4/xattr.c in the Linux kernel through 4.15.15 does not properly validate xattr sizes, which causes misinterpretation of a size as an error code, and consequently allows attackers to cause a denial of service (get_acl NULL pointer dereference and system crash) via a crafted ext4 image.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.43%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.43% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (bugzilla.kernel.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu8 products
- linux< 4.15.0-24.26
- linux-aws< 4.15.0-1011.11
- linux-azure< 4.15.0-1014.14~16.04.1 | < 4.15.0-1014.14
- linux-gcp< 4.15.0-1014.14~16.04.1 | < 4.15.0-1010.10
- linux-hwe< 4.15.0-24.26~16.04.1
Debian1 product
- linux< 4.16.5-1
Linux1 product
- linux_kernel≤ 4.15.15
3 vendors · 10 products
