CVE-2016-9083: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local users to bypass integer overflow checks, and cause a denial of service (memory corruption) or have unspecified other impact, by leveraging access to a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call, aka a "state machine confusion bug."

Affected products

• Linux Linux Kernel: from 3.6, before 3.10.107 (fixed in 3.10.107); from 3.11, before 3.12.70 (fixed in 3.12.70); from 3.13, before 3.16.39 (fixed in 3.16.39); from 3.17, before 3.18.51 (fixed in 3.18.51); from 3.19, before 4.1.41 (fixed in 4.1.41); from 4.2, before 4.4.65 (fixed in 4.4.65); …

Published 2016-11-28. Last modified 2026-06-17.