CVE-2016-5696: Google Android

Medium severity, CVSS 4.8. EPSS: 15.1% chance of exploitation in the next 30 days.

net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.

Affected products

• Google Android: up to and including 7.0
• Linux Linux Kernel: up to and including 4.6.6
• Oracle Vm Server: version 3.3 only; version 3.4 only

Published 2016-08-06. Last modified 2026-06-17.