CVE-2017-18202

The __oom_reap_task_mm function in mm/oom_kill.c in the Linux kernel before 4.14.4 mishandles gather operations, which allows attackers to cause a denial of service (TLB entry leak or use-after-free) or possibly have unspecified other impact by triggering a copy_to_user call within a certain time window.

• CWE-416

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=687cb0884a714ff484d038e9190edc874edcf146Patch, Vendor Advisory
• http://www.securityfocus.com/bid/103161Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:2772Third Party Advisory
• https://github.com/torvalds/linux/commit/687cb0884a714ff484d038e9190edc874edcf146Patch, Third Party Advisory
• https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.4Vendor Advisory
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=687cb0884a714ff484d038e9190edc874edcf146Patch, Vendor Advisory
• http://www.securityfocus.com/bid/103161Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:2772Third Party Advisory
• https://github.com/torvalds/linux/commit/687cb0884a714ff484d038e9190edc874edcf146Patch, Third Party Advisory
• https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.4Vendor Advisory

Published

Feb 27, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-18197In mxGraphViewImageReader.java in mxGraph before 3.7.6, the …
• CVE-2017-18198print_iso9660_recurse in iso-info.c in GNU libcdio before 1.…
• CVE-2017-18199realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows…
• CVE-2017-1820Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-18200The f2fs implementation in the Linux kernel before 4.14 mish…
• CVE-2017-18201An issue was discovered in GNU libcdio before 2.0.0. There i…
• CVE-2017-18203The dm_get_from_kobject function in drivers/md/dm.c in the L…
• CVE-2017-18204The ocfs2_setattr function in fs/ocfs2/file.c in the Linux k…
• CVE-2017-18205In builtin.c in zsh before 5.4, when sh compatibility mode i…
• CVE-2017-18206In utils.c in zsh before 5.4, symlink expansion had a buffer…
• CVE-2017-18207The Wave_read._read_fmt_chunk function in Lib/wave.py in Pyt…
• CVE-2017-18208The madvise_willneed function in mm/madvise.c in the Linux k…