Denial of Service Vulnerability in Linux Package - CVE-2016-8660
Summary
DEBIAN-CVE-2016-8660: The XFS subsystem in the Linux kernel through 4.8.2 allows local users to cause a denial of service (fdatasync failure and system hang) by using the vfs syscall group in the trinity program, related to a "page lock order... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing system resources and hardware interactions. It is widely used across various distributions and versions, including Debian 11, 12, 13, and 14. The package is known for its stability and performance, but it is susceptible to vulnerabilities that can affect system reliability and security.
Vulnerability Detail
The vulnerability identified as CVE-2016-8660 affects the XFS subsystem in the Linux kernel up to version 4.8.2. It allows local users to cause a denial of service by triggering an fdatasync failure and system hang through the vfs syscall group in the trinity program. This issue is related to a page lock order bug in the XFS seek hole/data implementation, which can lead to significant disruptions in system operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the trinity program's vfs syscall group until the package is updated. This may help in preventing the denial of service until a proper fix is applied.
Conclusion
CVE-2016-8660 is a significant vulnerability in the Linux package that can lead to denial of service. Users are encouraged to update their systems to mitigate the risk associated with this issue. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2016-8660 is a vulnerability in the XFS subsystem of the Linux kernel that can lead to a denial of service.
It can cause your system to hang and fail to perform fdatasync operations, disrupting normal functionality.
The vulnerability affects Linux kernel versions up to 4.8.2 across Debian 11, 12, 13, and 14.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability.
Yes, updating the Linux package to a version above 4.8.2 will resolve the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
