CVE-2014-9710: Linux Kernel

Medium severity, CVSS 6.9. EPSS: 0.3% chance of exploitation in the next 30 days.

The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit.

Affected products

• Linux Linux Kernel: before 3.10.83 (fixed in 3.10.83); from 3.11, before 3.12.45 (fixed in 3.12.45); from 3.13, before 3.14.47 (fixed in 3.14.47); from 3.15, before 3.16.35 (fixed in 3.16.35); from 3.17, before 3.18.19 (fixed in 3.18.19)

Published 2015-05-27. Last modified 2026-06-17.