CVE-2017-16995

HIGHNVD 7.87.8—Weaponized

7.8

EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.

High severity, but no confirmed exploitation yet

CISA-KEV: Not listedEPSS: 30%CVSS: 7.8Exploit: NoneExposed: 0

A fix is available — apply it.

The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension.

CVSS v3: 7.8
EG Score: 7.8(medium)
EPSS: 98.0%
KEV: Not listed

Published

December 27, 2017

Last Modified

May 13, 2026

References (28)

security@debianhttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f
security@debianhttp://openwall.com/lists/oss-security/2017/12/21/2
security@debianhttp://www.securityfocus.com/bid/102288
security@debianhttps://bugs.chromium.org/p/project-zero/issues/detail?id=1454
security@debianhttps://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=a6132276ab5dcc38b3299082efeb25b948263adb
security@debianhttps://github.com/torvalds/linux/commit/95a762e2c8c942780948091f8f2a4f32fce1ac6f
security@debianhttps://usn.ubuntu.com/3619-1/
security@debianhttps://usn.ubuntu.com/3619-2/
security@debianhttps://usn.ubuntu.com/3633-1/
security@debianhttps://usn.ubuntu.com/usn/usn-3523-2/
security@debianhttps://www.debian.org/security/2017/dsa-4073
security@debianhttps://www.exploit-db.com/exploits/44298/
security@debianhttps://www.exploit-db.com/exploits/45010/
security@debianhttps://www.exploit-db.com/exploits/45058/
af854a3a-2127-422b-91ae-364da2661108http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f

Patch Availability(6)

Vendor / Ecosystem	Fixed in / Patch	Released	Source
ubuntu	linux-image-raspi2 (4.13.0.1011.9) @ artful	2026-05-22	ubuntu
ubuntu	linux-image-extra-4.4.0-119-generic (4.4.0-119.143~14.04.1) @ trusty	2026-05-22	ubuntu
ubuntu	linux-image-extra-4.13.0-26-generic (4.13.0-26.29~16.04.2) @ xenial	2026-05-22	ubuntu
ubuntu	linux-image-extra-4.4.0-9026-euclid (4.4.0-9026.28) @ xenial	2026-05-22	ubuntu
ubuntu	linux-image-lowlatency (4.13.0.25.26) @ artful	2026-05-22	ubuntu
ubuntu	linux-image-extra-4.4.0-119-generic (4.4.0-119.143) @ xenial	2026-05-22	ubuntu

Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.

All Vendor Advisories

(6)

Every vendor that published an advisory referencing this CVE — pulled from our cve_vendor_advisories aggregation. Click any row for the vendor's original advisory page.

Data Freshness Timeline

(refreshed 5× in last 7d / 25× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

2026-07-07 13:42 UTCEPSS rescore
2026-07-05 02:27 UTCEPSS rescore
2026-07-04 06:28 UTCEPSS rescore
2026-07-01 15:02 UTCEPSS rescore
2026-07-01 15:02 UTCEPSS rescore
2026-06-28 04:53 UTCEPSS rescore
2026-06-27 03:05 UTCEPSS rescore
2026-06-25 13:47 UTCEPSS rescore
2026-06-25 13:47 UTCEPSS rescore
2026-06-24 14:02 UTCEPSS rescore
2026-06-23 21:30 UTCEPSS rescore
2026-06-22 20:05 UTCOSV refresh
2026-06-21 01:57 UTCEPSS rescore
2026-06-21 01:57 UTCEPSS rescore
2026-06-18 17:50 UTCEPSS rescore
2026-06-17 17:50 UTCEPSS rescore
2026-06-16 17:50 UTCEPSS rescore
2026-06-15 17:45 UTCEPSS rescore
2026-06-14 23:14 UTCEPSS rescore
2026-06-14 23:14 UTCEPSS rescore
2026-06-13 22:57 UTCEPSS rescore
2026-06-12 23:09 UTCEPSS rescore
2026-06-10 22:15 UTCEPSS rescore
2026-06-07 15:22 UTCEPSS rescore
2026-06-07 15:22 UTCEPSS rescore

Show 29 more

2026-06-06 13:45 UTCEPSS rescore
2026-06-06 13:45 UTCEPSS rescore
2026-06-05 22:44 UTCEPSS rescore
2026-06-05 10:04 UTCOSV refresh
2026-06-05 06:08 UTCEPSS rescore
2026-06-05 06:08 UTCEPSS rescore
2026-06-04 13:10 UTCEPSS rescore
2026-06-04 13:10 UTCEPSS rescore
2026-06-02 20:11 UTCEPSS rescore
2026-06-02 20:11 UTCEPSS rescore
2026-06-01 13:49 UTCEPSS rescore
2026-06-01 13:49 UTCEPSS rescore
2026-05-31 22:28 UTCEPSS rescore
2026-05-28 13:42 UTCEPSS rescore
2026-05-28 13:42 UTCEPSS rescore
2026-05-27 13:38 UTCEPSS rescore
2026-05-27 13:38 UTCEPSS rescore
2026-05-26 13:42 UTCEPSS rescore
2026-05-26 13:42 UTCEPSS rescore
2026-05-22 21:15 UTCEPSS rescore
2026-05-22 21:15 UTCEPSS rescore
2026-05-22 21:15 UTCEPSS rescore
2026-05-22 06:59 UTCEG score recompute
2026-05-22 06:59 UTCVendor advisory
2026-05-22 06:58 UTCGHSA enrichment
2026-05-20 22:37 UTCEPSS rescore
2026-05-20 22:37 UTCEPSS rescore
2026-05-18 21:30 UTCEPSS rescore
2026-05-18 21:30 UTCEPSS rescore

Publicly available exploits

(6 references)

Working exploit code is in the public domain (1 Metasploit module) (2 GitHub PoCs) (3 Exploit-DB entries). Defenders should treat patch urgency accordingly — public PoCs typically lead to mass-exploitation within 24-72 hours.

GitHub PoCph4ntonn/CVE-2017-16995
First seen Jan 28, 2021
👻CVE-2017-16995
Open source ↗
Exploit-DBEDB-45058✓ verified
First seen Jul 19, 2018
Linux - BPF Sign Extension Local Privilege Escalation (Metasploit)
Open source ↗
Exploit-DBEDB-45010✓ verified
First seen Jul 10, 2018
Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27) - Local Privilege Escalation
Open source ↗
GitHub PoCAl1ex/CVE-2017-16995
First seen Apr 26, 2018
CVE-2017-16995（Ubuntu本地提权漏洞）
Open source ↗
Exploit-DBEDB-44298
First seen Mar 16, 2018
Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation
Open source ↗
Metasploitexploit/linux/local/bpf_sign_extension_priv_esc✓ verified
First seen Nov 12, 2017
Linux BPF Sign Extension Local Privilege Escalation
Open source ↗

Frequently asked(5)

What is CVE-2017-16995?

CVE-2017-16995 is a high vulnerability published on December 27, 2017. The checkaluop function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension.

When was CVE-2017-16995 disclosed?

CVE-2017-16995 was first published in the National Vulnerability Database on December 27, 2017, with the most recent update on May 13, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.

Is CVE-2017-16995 actively exploited?

CVE-2017-16995 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 98.0% percentile likelihood of exploitation in the next 30 days — higher percentiles indicate greater predicted risk.

What is the CVSS score of CVE-2017-16995?

CVE-2017-16995 has a CVSS v3 base score of 7.8 (NVD).

How do I remediate CVE-2017-16995?

Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2017-16995, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2017-16995

Explore →

Is Your Infrastructure Affected by CVE-2017-16995?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs