CVE-2014-3631: Linux Kernel

High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days.

The assoc_array_gc function in the associative-array implementation in lib/assoc_array.c in the Linux kernel before 3.16.3 does not properly implement garbage collection, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via multiple "keyctl newring" operations followed by a "keyctl timeout" operation.

Affected products

• Linux Linux Kernel: from 3.13, before 3.14.19 (fixed in 3.14.19); from 3.15, before 3.16.3 (fixed in 3.16.3)

Published 2014-09-28. Last modified 2026-06-17.