DescriptionThe __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table, which allows local users to obtain root access on non-SMEP platforms via a crafted application. NOTE: this vulnerability exists because of incorrect backporting of the CVE-2016-9178 patch to older kernels.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)buster4.19.249-2fixed
buster (security)4.19.304-1fixed
bullseye (security)5.10.216-1fixed
bookworm (security)6.1.90-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsource(unstable)(not affected)


- linux <not-affected> (Vulnerable code not present)
No incorrect backport of CVE-2016-9178 done in Debian
This is only an issue if 1c109fabbd51863475cd12ac206bdd249aee35af
(added in 4.8) is backported without also backporting
548acf19234dbda5a52d5a8e7e205af46e9da840 (added in 4.6), as such
src:linux was never affected. 1c109fabbd5 also wasn't backported to
the 3.2 and 3.16 LTS series

Search for package or bug name: Reporting problems