CVE-2016-8666

Name	CVE-2016-8666
Description	The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	buster	4.19.249-2	fixed
	buster (security)	4.19.282-1	fixed
	bullseye	5.10.178-3	fixed
	bullseye (security)	5.10.179-1	fixed
	bookworm, sid	6.1.27-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
linux	source	wheezy	(not affected)
linux	source	jessie	3.6.36-1
linux	source	(unstable)	4.6.1-1

Notes

[wheezy] - linux <not-affected> (Vulnerable code introduced later)
Fixed by: https://git.kernel.org/linus/fac8e0f579695a3ecbc4d3cac369139d7f819971
Introduced by: htttps://git.kernel.org/linus/bf5a755f5e9186406bbf50f4087100af5bd68e40
https://www.openwall.com/lists/oss-security/2016/10/13/11