CVE-2016-10906

What it actually does

Use-after-free triggered by a race condition between arc_emac_tx and arc_emac_tx_clean in the ARC Ethernet MAC driver, allowing local attackers to corrupt kernel memory.

Why it matters to the business

On systems still running vulnerable kernels, local users or processes can cause crashes, denial of service, or potential privilege escalation, increasing operational risk and unplanned downtime for older Linux deployments.

How an attack unfolds

An attacker with local access crafts network traffic or driver interactions that concurrently invoke the transmit and cleanup paths, winning the race to dereference freed memory and execute arbitrary kernel code or crash the system.

How to fix it

Upgrade the Linux kernel to a version containing commit c278c253f3d992c6994d08aa0efb2b6806ca396f (equivalent to 4.5 or later stable releases) and rebuild any custom modules that depend on the ARC EMAC driver.

How to confirm the fix worked

Verify the running kernel version is 4.5 or newer, confirm the presence of the fix commit in the source tree, and test that concurrent transmit/cleanup operations no longer trigger use-after-free warnings under memory debugging tools such as KASAN.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux system
2. Trigger concurrent execution of arc_emac_tx and arc_emac_tx_clean through network activity or crafted packets
3. Win the race condition to perform use-after-free access
4. Leverage resulting memory corruption for code execution or denial of service

How to detect it

Review kernel logs for use-after-free warnings or KASAN reports referencing emac_main.c, monitor for unexpected crashes in the ARC EMAC transmit path, and correlate with local user activity on systems known to use the affected driver.

What your security team should do

• Immediately identify and inventory all systems still running kernels older than 4.5 that include the ARC EMAC driver
• Prioritize patching production systems that expose the driver to any local users or containers
• Apply the fixed commit or newer kernel packages and schedule reboot windows
• Monitor for local privilege-escalation attempts while legacy kernels remain in service