CVE-2018-13406: Canonical Ubuntu Linux

High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days.

An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel before 4.17.4 could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only
• Debian Debian Linux: version 8.0 only
• Linux Linux Kernel: from 2.6.24, before 3.16.58 (fixed in 3.16.58); from 3.17, before 3.18.114 (fixed in 3.18.114); from 3.19, before 4.4.139 (fixed in 4.4.139); from 4.5, before 4.9.111 (fixed in 4.9.111); from 4.10, before 4.14.53 (fixed in 4.14.53); from 4.15, before 4.17.4 (fixed in 4.17.4)

Published 2018-07-06. Last modified 2026-06-17.