PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-6214 Linux CVE debrief

CVE-2017-6214 is a Linux kernel availability issue in tcp_splice_read that can trigger an infinite loop and soft lockup when processing a TCP packet with the URG flag. The public NVD record classifies the issue as network-reachable, unauthenticated, and availability-only, with affected Linux kernel versions through 4.9.10 and a fix available in 4.9.11. For defenders, this is primarily a patch-management issue on any host still running an affected kernel, especially systems that expose TCP services or must remain highly available.

Vendor
Linux
Product
CVE-2017-6214
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-23
Original CVE updated
2026-05-13
Advisory published
2017-02-23
Advisory updated
2026-05-13

Who should care

Linux distribution maintainers, kernel and platform teams, and operators of servers or appliances running Linux kernels at or below 4.9.10. Prioritize internet-facing systems and any workload where a soft lockup or node hang would materially affect service availability.

Technical summary

The issue is in tcp_splice_read in net/ipv4/tcp.c. According to the NVD summary, a TCP packet carrying the URG flag can cause the function to loop indefinitely, leading to a soft lockup and denial of service. NVD assigns CWE-835 (Loop with Unreachable Exit Condition). The CVSS v3.0 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting a remotely triggerable availability impact without confidentiality or integrity effects.

Defensive priority

High for any affected kernel that serves production or internet-facing traffic; medium for isolated systems once patch status is confirmed. The risk is operational interruption rather than data compromise, but the unauthenticated network trigger makes it worth prompt remediation.

Recommended defensive actions

  • Upgrade Linux kernels to 4.9.11 or a vendor backported build that includes the fix.
  • Inventory systems running kernels through 4.9.10 and confirm patch status across bare metal, VMs, and containers that share the host kernel.
  • Treat exposed or high-availability TCP servers as first-priority remediation targets.
  • Validate remediation using the vendor/kernel package changelog rather than version strings alone, since distributors may backport fixes.
  • If immediate patching is not possible, reduce exposure by limiting unnecessary network access to affected hosts until the kernel is updated.

Evidence notes

The supplied NVD record states that Linux kernel versions through 4.9.10 are vulnerable and that the issue is a remotely reachable denial of service with CVSS v3.0 7.5. The official reference list includes the upstream Linux commit and the Linux 4.9.11 ChangeLog, which support the conclusion that the fix is present in 4.9.11. The CVE was published on 2017-02-23 and no KEV entry is supplied in the provided data.

Official resources

Published 2017-02-23; last modified 2026-05-13 in the supplied source record. Not listed in the supplied KEV enrichment data.