CVE-2017-9986

HIGH 7.8 ALL-YEARS

Published 2017-06-28 · Last modified 2024-08-05 · mitre · NVD: Modified

The intr function in sound/oss/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a "double fetch" vulnerability.

ELEVATED IMPACT

Severe if exploited (CVSS 7.8), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 30th percentile

○ In CISA KEV○ Catalogued PoC

Impact if exploited

7.8CVSS 3.0 · HIGH · NVD

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

What an attacker needs

⚠Access: Requires local access to the host
⚠Privileges: Requires a low-privilege account
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Linux

Products Linux Kernel

Weakness (CWE)

CWE-125: Out-of-bounds read

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References and research data (JSON)

Vendor product assessments

Showing 32 of 56 vendor product statements; 24 omitted. Read the full vendor advisory.

kernel.src as a component of Red Hat Enterprise Linux 5 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel?arch=src
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-abi-whitelists as a component of Red Hat Enterprise Linux 6 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-abi-whitelists
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-debug as a component of Red Hat Enterprise Linux 6 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-debug
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-debug-devel as a component of Red Hat Enterprise Linux 6 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-debug-devel
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-doc as a component of Red Hat Enterprise Linux 6 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-doc
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-headers as a component of Red Hat Enterprise Linux 6 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-headers
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-kdump-devel as a component of Red Hat Enterprise Linux 6 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-kdump-devel
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel.src as a component of Red Hat Enterprise Linux 6 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel?arch=src
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
python-perf as a component of Red Hat Enterprise Linux 6 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/python-perf
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-alt.src as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-alt?arch=src
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-debug as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-debug
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-debug-devel as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-debug-devel
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-doc as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-doc
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-kdump as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-kdump
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-rt as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-rt
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-rt-debug as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-rt-debug
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-rt-debug-kvm as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-rt-debug-kvm
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-rt-doc as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-rt-doc
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-rt-trace as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-rt-trace
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-rt-trace-devel as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-rt-trace-devel
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-rt.src as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-rt?arch=src
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-tools-libs as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-tools-libs
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel.src as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel?arch=src
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
python-perf as a component of Red Hat Enterprise Linux 7 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/python-perf
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-rt as a component of Red Hat Enterprise MRG 2 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-rt
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-rt-debug-devel as a component of Red Hat Enterprise MRG 2 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-rt-debug-devel
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-rt-doc as a component of Red Hat Enterprise MRG 2 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-rt-doc
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-rt-trace as a component of Red Hat Enterprise MRG 2 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-rt-trace
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-rt-trace-devel as a component of Red Hat Enterprise MRG 2 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-rt-trace-devel
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
kernel-rt-vanilla-devel as a component of Red Hat Enterprise MRG 2 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/kernel-rt-vanilla-devel
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
mrg-rt-release as a component of Red Hat Enterprise MRG 2 · known not affected

Vendor assessment for this product only.
Reason: vulnerable code not present

pkg:rpm/redhat/mrg-rt-release
Red Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00

Known Affected Software Configurations

Vendor	Product	Version range
Linux	Linux Kernel	≤ 4.11.7

All CVSS metrics

HIGH 7.8 v3.0 · NVD Primary
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
HIGH 7.2 v2.0 · NVD Primary
AV:L/AC:L/Au:N/C:C/I:C/A:C

References

Advisories

https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-9986.json vendor-advisoryRed Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-18895 ADVISORYEUVD · EUVD-2017-18895

Technical & other

http://www.securityfocus.com/bid/99336 vdb-entryx_refsource_BIDx_transferredCVE record · mitre · Updated 2017-06-30T09:57:01.000Z
CVE record · CVE · Updated 2024-08-05T17:25:00.567Z
NVD · CVE-2017-9986 · Updated 2026-06-17T01:29:19.647
https://bugzilla.kernel.org/show_bug.cgi?id=196135 x_refsource_MISCx_transferredIssue TrackingCVE record · mitre · Updated 2017-06-30T09:57:01.000Z
CVE record · CVE · Updated 2024-08-05T17:25:00.567Z
NVD · CVE-2017-9986 · Updated 2026-06-17T01:29:19.647
https://access.redhat.com/security/cve/CVE-2017-9986 vendor-referenceRed Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
https://bugzilla.redhat.com/show_bug.cgi?id=1470211 vendor-referenceRed Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
https://www.cve.org/CVERecord?id=CVE-2017-9986 vendor-referenceRed Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00
https://nvd.nist.gov/vuln/detail/CVE-2017-9986 vendor-referenceRed Hat · CVE-2017-9986 · Updated 2026-05-13T04:02:08+00:00

Sources: NVD · CVE.org · All sources and attribution · EPSS