CVE-2016-6198

kernel: vfs: missing detection of hardlinks in vfs_rename() on overlayfs

Loading…

Severity

Moderate

Red Hat Product Security

5.5

CVSS 3.0

Review impact separately from score.

Published · July 11, 2016

Updated · November 2, 2026

Description

A flaw was found that the vfs_rename() function did not detect hard links on overlayfs. A local, unprivileged user could use the rename syscall on overlayfs on top of xfs to crash the system.

Statement

This issue is not present in the Linux kernel packages as shipped with Red Hat Enterprise Linux versions 5 and 6.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. Future Linux kernel updates for the respective releases may address this issue.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 5.5
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0 · 4.7
AV:L/AC:M/Au:N/C:N/I:N/A:C

CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization