Linux Kernel Integer Overflow

What to do

1. Update Pan-os to 7.1.23 or 8.0.16 or 8.1.7, whichever matches your release line, or a later version.
2. Update Big-ip Access Policy Manager to 11.6.4 or 12.1.5 or 13.1.1.5 or 14.0.1.1, whichever matches your release line, or a later version.
3. Update Big-ip Advanced Firewall Manager to 11.6.4 or 12.1.5 or 13.1.1.5 or 14.0.1.1, whichever matches your release line, or a later version.
4. CISA's required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected products and versions

Version data comes from the organisation that assigned the CVE; 4 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector

LocalThe attacker needs local access or must trick a user into running something.

Attack complexity

LowNo special conditions are needed; the attack works reliably.

Privileges required

LowA basic user account is enough.

User interaction

NoneNo action by a victim is required.

Scope

UnchangedImpact stays within the vulnerable component.

Confidentiality

HighAll data handled by the component can be read.

Integrity

HighData or code can be modified at will.

Availability

HighThe component can be taken down completely.

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Integer Overflow or Wraparound

Timeline

1. September 25, 2018CVE record published.
2. January 26, 2026Added to CISA's Known Exploited Vulnerabilities catalogue.
3. January 27, 2026CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
4. February 16, 2026Deadline for US federal agencies to remediate, set by CISA.
5. June 17, 2026Record last changed materially (score, affected products, status or references).

References

Recent Integer Overflow or Wraparound vulnerabilities

• 8.8 High severity

  Adobe Flash Player and AIR Integer Overflow Exploited

  CVE-2016-1010Mar 12, 2016AdobeEPSS 19.3%
• 8.8 High severity

  Adobe Flash Player Integer Overflow Exploited

  CVE-2015-8651Dec 28, 2015AdobeEPSS 67.7%
• 9.8 Critical severity

  Adobe Reader and Acrobat Arbitrary Integer Overflow Exploited

  CVE-2013-2729May 16, 2013AdobeEPSS 66.6%
• 7.8 High severity

  Linux Kernel Integer Overflow Exploited

  CVE-2013-2596Apr 13, 2013LinuxEPSS 3.21%
• 8.8 High severity

  Adobe Flash Player Integer Overflow Exploited

  CVE-2012-5054Sep 24, 2012AdobeEPSS 21.2%
• 7.8 High severity

  Android OS Privilege Escalation Exploited

  CVE-2011-1823Jun 9, 2011GoogleEPSS 41.4%

Spotted an error? Tell us.