CVE-2016-6213

What it actually does

The flaw permits an unbounded number of MS_BIND mount operations within a mount namespace, leading to exponential growth in mount structures, memory exhaustion, and eventual deadlock in the kernel.

Why it matters to the business

Local processes can render Linux systems unresponsive or force reboots, disrupting workloads and services until the host is recovered; the issue has been resolved for years in all maintained kernel branches.

How an attack unfolds

A local attacker compiles or runs a simple program that repeatedly issues MS_BIND mount system calls inside a dedicated mount namespace, triggering rapid growth in kernel mount tables until memory pressure causes a deadlock.

How to fix it

Upgrade the Linux kernel to version 4.9 or later; the fix is present in commit d29216842a85c7970c536108e093963f02714498. Rebuild and reboot into the updated kernel; no configuration changes are required.

How to confirm the fix worked

Confirm the running kernel is 4.9 or newer via uname -r; attempt to reproduce the mount loop in a test namespace and verify the operation is now rate-limited or rejected.

Typical attack path

1. Obtain local shell access on a vulnerable Linux system
2. Create a new mount namespace (unshare(CLONE_NEWNS))
3. Execute a loop that performs repeated MS_BIND mounts of a directory onto itself or another location
4. Observe kernel memory consumption and eventual system deadlock or OOM

How to detect it

Review system logs for repeated mount-related messages or rapid increases in mount count; examine process activity for unusual unshare or mount syscall patterns; no public exploit artifacts are known.

What your security team should do

• Ensure all production Linux hosts run kernels 4.9 or newer
• Include kernel version checks in regular vulnerability scanning
• Review any custom or embedded Linux images for back-level kernels