CVE-2016-8666
kernel: Remotely triggerable recursion in GRE code leading to kernel crash
Severity
ImportantRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · October 13, 2016
Updated · June 28, 2026
Description
A flaw was found in the way the Linux kernel's networking subsystem handled offloaded packets with multiple layers of encapsulation in the GRO (Generic Receive Offload) code path. A remote attacker could use this flaw to trigger unbounded recursion in the kernel that could lead to stack corruption, resulting in a system crash.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 · 7.1AV:N/AC:M/Au:N/C:N/I:N/A:C
CWE-674 · Uncontrolled Recursion