CVE-2016-9191

The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service (system hang) by leveraging access to a container environment for executing a crafted application, as demonstrated by trinity.

• CWE-20
• CWE-399

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=93362fa47fe98b62e4a34ab408c4a418432e7939
• http://www.debian.org/security/2017/dsa-3791
• http://www.openwall.com/lists/oss-security/2016/11/05/4Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94129Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1392439Issue Tracking
• https://github.com/torvalds/linux/commit/93362fa47fe98b62e4a34ab408c4a418432e7939
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03802en_us
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=93362fa47fe98b62e4a34ab408c4a418432e7939
• http://www.debian.org/security/2017/dsa-3791
• http://www.openwall.com/lists/oss-security/2016/11/05/4Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94129Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1392439Issue Tracking
• https://github.com/torvalds/linux/commit/93362fa47fe98b62e4a34ab408c4a418432e7939
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03802en_us

Published

Nov 28, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9185In OpenStack Heat, by launching a new Heat stack with a loca…
• CVE-2016-9186Unrestricted file upload vulnerability in the "legacy course…
• CVE-2016-9187Unrestricted file upload vulnerability in the double extensi…
• CVE-2016-9188Cross-site scripting (XSS) vulnerabilities in Moodle CMS on …
• CVE-2016-9189Pillow before 3.3.2 allows context-dependent attackers to ob…
• CVE-2016-9190Pillow before 3.3.2 allows context-dependent attackers to ex…
• CVE-2016-9192A vulnerability in Cisco AnyConnect Secure Mobility Client f…
• CVE-2016-9193A vulnerability in the malicious file detection and blocking…
• CVE-2016-9194A vulnerability in 802.11 Wireless Multimedia Extensions (WM…
• CVE-2016-9195A vulnerability in RADIUS Change of Authorization (CoA) requ…
• CVE-2016-9196A vulnerability in login authentication management in Cisco …
• CVE-2016-9197A vulnerability in the CLI command parser of the Cisco Mobil…