A cache invalidation bug in Linux memory management

Summary: Google Project Zero's Jann Horn described exploiting CVE-2018-17182, a Linux kernel bug present since version 3.16, in which 32-bit sequence numbers used to invalidate per-thread VMA caches could overflow and let a thread reuse freed VMA pointers. Fixes shipped in upstream stable releases 4.18.9, 4.14.71, 4.9.128, 4.4.157 and 3.16.58, and the bug is reachable via mmap(), munmap() and clone(), syscalls permitted even in seccomp sandboxes such as the Chrome renderer and Docker's default policy.
What's compelling: The exploit worked against Ubuntu 18.04's 4.15.0-34 kernel, which enables neither kernel.panic_on_oops nor kernel.dmesg_restrict, so an attacker can retry and read crash logs; the same syscalls the bug needs are whitelisted inside sandboxes you may already trust.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2018-17182
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026