PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9401 Redhat CVE debrief

CVE-2016-9401 is a local bash issue tied to popd path handling. According to NVD, a local user may be able to bypass a restricted shell and trigger a use-after-free with a crafted address. The published impact is availability-focused, but the restricted-shell bypass makes this important anywhere bash is part of a controlled local access model.

Vendor
Redhat
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

Linux administrators, distro security teams, and operators who rely on bash restricted shells or shared local accounts should care most. Systems running affected GNU bash builds or vendor packages referenced in the Red Hat, Debian LTS, or Gentoo advisories should be prioritized.

Technical summary

NVD classifies the issue as CWE-416 (use-after-free) with CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is described as a local attack against bash's popd behavior, where a crafted address may let a user bypass restricted-shell constraints. The corpus ties the issue to GNU bash and multiple distro package lines, including Red Hat, Debian, and Gentoo references.

Defensive priority

Medium, and higher in environments that depend on restricted shells or local shell confinement. Patch promptly on any supported system with affected bash packages.

Recommended defensive actions

  • Apply the bash security updates referenced by your vendor advisory for the affected platform.
  • Verify the installed bash package version against the affected CPEs in NVD, including GNU bash 4.4 patch levels and the distro releases listed in the record.
  • Review any restricted-shell usage to ensure local users cannot reach popd-related paths unexpectedly.
  • Limit unnecessary local shell access and watch for abnormal bash crashes or shell-restriction violations until remediation is complete.
  • Confirm remediation with the exact vendor package metadata for your system, not just the CVE entry.

Evidence notes

The source corpus shows NVD publication on 2017-01-23 and later modification on 2026-05-13. NVD metadata lists CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H and CWE-416. The reference set includes two oss-security posts dated 2016-11-17, plus Red Hat, Debian LTS, and Gentoo advisories, which supports an earlier public disclosure timeline before the NVD publication date.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9401 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9401

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9401 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9401

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.