# CVE-2017-16995 — Linux Kernel > As of 2026-11-11, CVE-2017-16995 is a HIGH-severity vulnerability in Linux Kernel, CVSS v3.1 7.8, EPSS 30.0% (98.2th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2017-16995, most recently “eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)”. **Last updated:** 2026-11-11 ## What is CVE-2017-16995? The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension. The record classifies CVE-2017-16995 under weakness class [CWE-119](https://intel.threadlinqs.com/cwe/CWE-119). Its CVSS v3 base vector states that the flaw requires local access to the host, needs low-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 4 affected-product entries are recorded, across 3 vendors, listed below. The identifier was first published 3247 days ago. ## Severity and exploitation probability - **CVSS v3.1 base score:** 7.8 — HIGH (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`) - **EPSS (FIRST):** 30.0% probability of exploitation in the next 30 days, higher than 98.2% of all scored CVEs - **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog - **Threadlinqs priority:** 9.8/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability - **Published:** 2017-12-22 ## Is CVE-2017-16995 being exploited? Weaponised exploit code for CVE-2017-16995 is publicly available. 11 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 38 in the Threadlinqs vulnerability feed. - [Al1ex/CVE-2017-16995](https://github.com/Al1ex/CVE-2017-16995) (github) - [ph4ntonn/CVE-2017-16995](https://github.com/ph4ntonn/CVE-2017-16995) (github) - [gugronnier/CVE-2017-16995](https://github.com/gugronnier/CVE-2017-16995) (github) - [senyuuri/cve-2017-16995](https://github.com/senyuuri/cve-2017-16995) (github) - [vnik5287/CVE-2017-16995](https://github.com/vnik5287/CVE-2017-16995) (github) - [littlebin404/CVE-2017-16995](https://github.com/littlebin404/CVE-2017-16995) (github) - [C0dak/CVE-2017-16995](https://github.com/C0dak/CVE-2017-16995) (github) - [Lumindu/CVE-2017-16995-Linux-Kernel---BPF-Sign-Extension-Local-Privilege-Escalation-](https://github.com/Lumindu/CVE-2017-16995-Linux-Kernel---BPF-Sign-Extension-Local-Privilege-Escalation-) (github) ## Affected products and versions - [Linux](https://intel.threadlinqs.com/vendors/linux): Kernel - [Debian](https://intel.threadlinqs.com/vendors/debian): Linux 9.0 - [Canonical](https://intel.threadlinqs.com/vendors/canonical): Ubuntu Linux 14.04, Ubuntu Linux 16.04 ## How to fix CVE-2017-16995 Vendor advisory: [http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f). Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory. ## Threat activity tracking CVE-2017-16995 1 tracked threat in the Threadlinqs corpus references CVE-2017-16995, either in the campaign’s CVE list or as an indicator on the campaign record. - [eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)](https://intel.threadlinqs.com/threat/TL-2026-5791) — MEDIUM · 2026-11-11 ## Sources Enriched from CVE.org, NVD, FIRST EPSS, GitHub Security Advisories, public proof-of-concept repositories. This product uses the NVD API but is not endorsed or certified by the NVD. **Vendor advisory and patch** - [usn.ubuntu.com — vendor advisory](https://usn.ubuntu.com/3619-2/) - [usn.ubuntu.com — vendor advisory (3633 1)](https://usn.ubuntu.com/3633-1/) - [debian.org — vendor advisory](https://www.debian.org/security/2017/dsa-4073) - [usn.ubuntu.com — vendor advisory (usn 3523 2)](https://usn.ubuntu.com/usn/usn-3523-2/) - [usn.ubuntu.com — vendor advisory (3619 1)](https://usn.ubuntu.com/3619-1/) **Exploit and proof of concept** - [exploit-db.com — exploit](https://www.exploit-db.com/exploits/45058/) - [exploit-db.com — exploit (44298)](https://www.exploit-db.com/exploits/44298/) - [exploit-db.com — exploit (45010)](https://www.exploit-db.com/exploits/45010/) **Vulnerability database entry** - [securityfocus.com — vdb entry](http://www.securityfocus.com/bid/102288) **Other references** - [github.com](https://github.com/torvalds/linux/commit/95a762e2c8c942780948091f8f2a4f32fce1ac6f) - [bugs.chromium.org](https://bugs.chromium.org/p/project-zero/issues/detail?id=1454) - [openwall.com](http://openwall.com/lists/oss-security/2017/12/21/2) - [git.kernel.org](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=95a762e2c8c942780948091f8f2a4f32fce1ac6f) _Showing 13 of 14 recorded references._ Canonical: https://intel.threadlinqs.com/cve/CVE-2017-16995 Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Sign up free (Blue): https://threadlinqs.com/?modal=signup Indicator values unlock with TL Creds (https://threadlinqs.com/tl-creds); MCP access for AI agents needs Purple: https://intel.threadlinqs.com/mcp