CVE-2017-15102: Canonical Ubuntu Linux

Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only
• Linux Linux Kernel: before 4.8.1 (fixed in 4.8.1)
• Red Hat Enterprise Linux: version 5.0 only; version 6.0 only

Published 2017-11-15. Last modified 2026-06-17.