PatchSiren cyber security CVE debrief
CVE-2016-8636 Linux CVE debrief
CVE-2016-8636 affects the Linux kernel’s Soft RoCE (rxe) RDMA path. An integer overflow in mem_check_range() can let a local user trigger unsafe read or write handling, resulting in memory corruption, possible kernel-memory disclosure, or other undefined impact on kernels before 4.9.10.
- Vendor
- Linux
- Product
- Unknown
- CVSS
- HIGH 7.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2017-02-22
- Original CVE updated
- 2026-05-13
- Advisory published
- 2017-02-22
- Advisory updated
- 2026-05-13
Who should care
Linux kernel maintainers, distribution security teams, and administrators running systems with Soft RoCE/RDMA enabled should pay attention, especially on multi-user hosts where untrusted local users may be able to reach the affected code path.
Technical summary
NVD describes an integer overflow in drivers/infiniband/sw/rxe/rxe_mr.c’s mem_check_range() function. The affected configuration is the Linux kernel from 4.8 up to but not including 4.9.10. The bug is reachable through RDMA read/write requests in the Soft RoCE implementation, and NVD rates the issue as locally exploitable with high confidentiality, integrity, and availability impact (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; CWE-190).
Defensive priority
High for any environment running a vulnerable kernel with Soft RoCE enabled, because the flaw is local but impacts kernel memory safety and can affect confidentiality, integrity, and availability.
Recommended defensive actions
- Upgrade Linux kernel systems to 4.9.10 or a vendor release that includes the backport of the upstream fix.
- Verify whether Soft RoCE (rxe) / RDMA over InfiniBand is enabled on your hosts; prioritize remediation on systems that expose this feature to untrusted local users.
- Apply distribution security advisories and backported patches referenced by your vendor, and confirm the fix is present in your deployed kernel build.
- Treat multi-user servers, shared lab systems, and any environment with local shell access as higher priority for patching and validation.
- After patching, confirm kernel version and vendor changelog references match the fixed release line rather than relying on package names alone.
Evidence notes
The CVE record and NVD entry both identify the issue as a Linux kernel integer overflow in the Soft RoCE rxe path, with vulnerable versions from 4.8 through before 4.9.10. NVD lists the impact as local and severe (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps it to CWE-190. The reference set includes the upstream kernel commit, the Linux 4.9.10 changelog, and an oss-security mailing list post dated 2017-02-11, which together support the fix and public disclosure timeline. NVD publication date: 2017-02-22; NVD last modified date: 2026-05-13.
Sources and references
Verified primary and authoritative sources
-
CVE-2016-8636 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2016-8636
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2016-8636 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8636
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://eyalitkin.wordpress.com/2017/02/11/cve-publication-cve-2016-8636/
[email protected] - Patch, Technical Description, Third Party Advisory
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://github.com/torvalds/linux/commit/647bf3d8a8e5777319da92af672289b2a6c4dc66
[email protected] - Issue Tracking, Patch, Third Party Advisory
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.