CVE-2016-9644

The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table, which allows local users to obtain root access on non-SMEP platforms via a crafted application. NOTE: this vulnerability exists because of incorrect backporting of the CVE-2016-9178 patch to older kernels.

• CWE-264

• http://www.openwall.com/lists/oss-security/2016/11/07/4Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94545
• http://www.ubuntu.com/usn/USN-3146-1
• http://www.ubuntu.com/usn/USN-3146-2
• https://lwn.net/Articles/705220/Product
• http://www.openwall.com/lists/oss-security/2016/11/07/4Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94545
• http://www.ubuntu.com/usn/USN-3146-1
• http://www.ubuntu.com/usn/USN-3146-2
• https://lwn.net/Articles/705220/Product

Published

Nov 28, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9636Heap-based buffer overflow in the flx_decode_delta_fli funct…
• CVE-2016-9637The (1) ioport_read and (2) ioport_write functions in Xen, w…
• CVE-2016-9638In BMC Patrol before 9.13.10.02, the binary "listguests64" i…
• CVE-2016-9639Salt before 2015.8.11 allows deleted minions to read or writ…
• CVE-2016-9642JavaScriptCore in WebKit allows attackers to cause a denial …
• CVE-2016-9643The regex code in Webkit 2.4.11 allows remote attackers to c…
• CVE-2016-9645The fix for ikiwiki for CVE-2016-10026 was incomplete result…
• CVE-2016-9646ikiwiki before 3.20161229 incorrectly called the CGI::FormBu…
• CVE-2016-9647Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-9648Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-9649Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-9650Blink in Google Chrome prior to 55.0.2883.75 for Mac, Window…