CVE-2016-8655

What it actually does

Race condition in net/packet/af_packet.c leads to use-after-free when changing socket version via packet_set_ring and packet_setsockopt under CAP_NET_RAW, enabling local privilege escalation or denial of service.

Why it matters to the business

Local attackers can gain full root access or crash Linux systems, risking complete compromise of servers and devices; high urgency due to weaponized public exploits despite age and stable EPSS.

How an attack unfolds

Attacker obtains local shell with CAP_NET_RAW, opens packet socket, and concurrently invokes packet_set_ring and packet_setsockopt to trigger the race, freeing memory still in use for arbitrary code execution or kernel panic. Public weaponized exploits facilitate rapid deployment.

How to fix it

Upgrade Linux kernel to a version containing commit 84ac7260236a49c79eede91617700174c2c19b0c or later; apply distribution-specific patches for torvalds/linux (GIT).

How to confirm the fix worked

Verify kernel source or binary contains commit 84ac7260236a49c79eede91617700174c2c19b0c; run targeted packet socket stress tests to confirm absence of use-after-free crashes.

Typical attack path

1. Gain local user access on affected Linux system
2. Ensure or acquire CAP_NET_RAW capability
3. Open AF_PACKET socket and prepare ring buffer
4. Trigger concurrent calls to packet_set_ring and packet_setsockopt
5. Exploit resulting use-after-free for privilege escalation or DoS

How to detect it

Review kernel audit logs and dmesg for af_packet related oops or use-after-free messages; correlate with processes exercising CAP_NET_RAW and unusual packet socket activity.

• packet_set_ring
• packet_setsockopt
• af_packet use-after-free
• net/packet/af_packet.c

What your security team should do

• Immediately upgrade all affected Linux kernels to the fixed commit version
• Audit and minimize use of CAP_NET_RAW capability across workloads
• Enable kernel hardening features such as KASAN or lockdown mode where available
• Monitor for local exploitation attempts given weaponized exploit maturity