{"id":"CVE-2018-17182","details":"An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations.","modified":"2026-04-16T06:17:50.634826127Z","published":"2018-09-19T09:29:00.620Z","related":["SUSE-SU-2018:3003-1","SUSE-SU-2018:3004-1","SUSE-SU-2018:3032-1","SUSE-SU-2018:3032-2","SUSE-SU-2018:3083-1","SUSE-SU-2018:3084-1","SUSE-SU-2018:3100-1","SUSE-SU-2018:3158-1","SUSE-SU-2018:3159-1","SUSE-SU-2018:3164-1","SUSE-SU-2018:3171-1","SUSE-SU-2018:3172-1","SUSE-SU-2018:3173-1","SUSE-SU-2018:3238-1","SUSE-SU-2018:3272-1","SUSE-SU-2018:3331-1","SUSE-SU-2018:3659-1","SUSE-SU-2018:3961-1","SUSE-SU-2019:0095-1"],"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/106503"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3777-3/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:3656"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3776-1/"},{"type":"ADVISORY","url":"https://www.openwall.com/lists/oss-security/2018/09/18/4"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3777-2/"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3776-2/"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3777-1/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2018/dsa-4308"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/105417"},{"type":"FIX","url":"https://github.com/torvalds/linux/commit/7a9cdebdcc17e426fb5287e4a82db1dfe86339b2"},{"type":"FIX","url":"https://security.netapp.com/advisory/ntap-20190204-0001/"},{"type":"FIX","url":"http://www.securitytracker.com/id/1041748"},{"type":"FIX","url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7a9cdebdcc17e426fb5287e4a82db1dfe86339b2"},{"type":"EVIDENCE","url":"https://www.exploit-db.com/exploits/45497/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/torvalds/linux","events":[{"introduced":"0"},{"fixed":"7a9cdebdcc17e426fb5287e4a82db1dfe86339b2"}]},{"type":"GIT","repo":"https://github.com/torvalds/linux","events":[{"introduced":"0"},{"fixed":"7a9cdebdcc17e426fb5287e4a82db1dfe86339b2"}]}],"versions":["v2.6.12-rc2","v2.6.12-rc3","v2.6.12-rc4","v2.6.13","v2.6.13-rc1","v2.6.13-rc2","v2.6.13-rc3","v2.6.13-rc4","v2.6.13-rc5","v2.6.13-rc6","v2.6.13-rc7","v2.6.14-rc1","v2.6.14-rc2","v2.6.14-rc3","v2.6.15-rc1","v2.6.15-rc2","v2.6.15-rc4","v2.6.15-rc5","v2.6.15-rc7","v2.6.16","v2.6.16-rc1","v2.6.16-rc2","v2.6.16-rc3","v2.6.16-rc4","v2.6.16-rc5","v2.6.16-rc6","v2.6.17","v2.6.17-rc1","v2.6.17-rc2","v2.6.17-rc3","v2.6.17-rc4","v2.6.17-rc5","v2.6.17-rc6","v2.6.18","v2.6.18-rc1","v2.6.18-rc2","v2.6.18-rc3","v2.6.18-rc5","v2.6.18-rc6","v2.6.19-rc1","v2.6.19-rc2","v2.6.20-rc1","v2.6.20-rc2","v2.6.20-rc3","v2.6.20-rc4","v2.6.20-rc5","v2.6.20-rc6","v2.6.20-rc7","v2.6.21","v2.6.21-rc1","v2.6.21-rc2","v2.6.21-rc3","v2.6.21-rc4","v2.6.21-rc5","v2.6.21-rc6","v2.6.21-rc7","v2.6.22","v2.6.22-rc1","v2.6.22-rc2","v2.6.22-rc3","v2.6.22-rc4","v2.6.22-rc5","v2.6.22-rc6","v2.6.22-rc7","v2.6.23","v2.6.23-rc1","v2.6.23-rc2","v2.6.23-rc3","v2.6.23-rc4","v2.6.23-rc5","v2.6.23-rc6","v2.6.23-rc7","v2.6.23-rc8","v2.6.23-rc9","v2.6.24","v2.6.24-rc1","v2.6.24-rc2","v2.6.24-rc3","v2.6.24-rc4","v2.6.24-rc5","v2.6.24-rc6","v2.6.24-rc7","v2.6.24-rc8","v2.6.25","v2.6.25-rc1","v2.6.25-rc2","v2.6.25-rc3","v2.6.25-rc4","v2.6.25-rc5","v2.6.25-rc6","v2.6.25-rc7","v2.6.25-rc8","v2.6.25-rc9","v2.6.26","v2.6.26-rc1","v2.6.26-rc2","v2.6.26-rc3","v2.6.26-rc4","v2.6.26-rc5","v2.6.26-rc6","v2.6.26-rc7","v2.6.26-rc8","v2.6.26-rc9","v2.6.27","v2.6.27-rc1","v2.6.27-rc2","v2.6.27-rc3","v2.6.27-rc4","v2.6.27-rc5","v2.6.27-rc6","v2.6.27-rc7","v2.6.27-rc8","v2.6.27-rc9","v2.6.28","v2.6.28-rc1","v2.6.28-rc2","v2.6.28-rc3","v2.6.28-rc4","v2.6.28-rc5","v2.6.28-rc6","v2.6.28-rc7","v2.6.28-rc8","v2.6.28-rc9","v2.6.29","v2.6.29-rc1","v2.6.29-rc2","v2.6.29-rc3","v2.6.29-rc4","v2.6.29-rc5","v2.6.29-rc6","v2.6.29-rc7","v2.6.29-rc8","v2.6.30","v2.6.30-rc1","v2.6.30-rc2","v2.6.30-rc3","v2.6.30-rc4","v2.6.30-rc5","v2.6.30-rc6","v2.6.30-rc7","v2.6.30-rc8","v2.6.31","v2.6.31-rc1","v2.6.31-rc2","v2.6.31-rc3","v2.6.31-rc4","v2.6.31-rc5","v2.6.31-rc6","v2.6.31-rc7","v2.6.31-rc8","v2.6.31-rc9","v2.6.32","v2.6.32-rc1","v2.6.32-rc2","v2.6.32-rc3","v2.6.32-rc4","v2.6.32-rc5","v2.6.32-rc6","v2.6.32-rc7","v2.6.32-rc8","v2.6.33","v2.6.33-rc1","v2.6.33-rc2","v2.6.33-rc3","v2.6.33-rc4","v2.6.33-rc5","v2.6.33-rc6","v2.6.33-rc7","v2.6.33-rc8","v2.6.34","v2.6.34-rc1","v2.6.34-rc2","v2.6.34-rc3","v2.6.34-rc4","v2.6.34-rc5","v2.6.34-rc6","v2.6.34-rc7","v2.6.35","v2.6.35-rc1","v2.6.35-rc2","v2.6.35-rc3","v2.6.35-rc4","v2.6.35-rc5","v2.6.35-rc6","v2.6.36","v2.6.36-rc1","v2.6.36-rc2","v2.6.36-rc3","v2.6.36-rc4","v2.6.36-rc5","v2.6.36-rc6","v2.6.36-rc7","v2.6.36-rc8","v2.6.37","v2.6.37-rc1","v2.6.37-rc2","v2.6.37-rc3","v2.6.37-rc4","v2.6.37-rc5","v2.6.37-rc6","v2.6.37-rc7","v2.6.37-rc8","v2.6.38","v2.6.38-rc1","v2.6.38-rc2","v2.6.38-rc3","v2.6.38-rc4","v2.6.38-rc5","v2.6.38-rc6","v2.6.38-rc7","v2.6.38-rc8","v2.6.39","v2.6.39-rc1","v2.6.39-rc2","v2.6.39-rc3","v2.6.39-rc4","v2.6.39-rc5","v2.6.39-rc6","v2.6.39-rc7","v3.0","v3.0-rc1","v3.0-rc2","v3.0-rc3","v3.0-rc4","v3.0-rc5","v3.0-rc6","v3.0-rc7","v3.1","v3.1-rc1","v3.1-rc10","v3.1-rc2","v3.1-rc3","v3.1-rc4","v3.1-rc5","v3.1-rc6","v3.1-rc7","v3.1-rc8","v3.1-rc9","v3.10","v3.10-rc1","v3.10-rc2","v3.10-rc3","v3.10-rc4","v3.10-rc5","v3.10-rc6","v3.10-rc7","v3.11","v3.11-rc1","v3.11-rc2","v3.11-rc3","v3.11-rc4","v3.11-rc5","v3.11-rc6","v3.11-rc7","v3.12","v3.12-rc1","v3.12-rc2","v3.12-rc3","v3.12-rc4","v3.12-rc5","v3.12-rc6","v3.12-rc7","v3.13","v3.13-rc1","v3.13-rc2","v3.13-rc3","v3.13-rc4","v3.13-rc5","v3.13-rc6","v3.13-rc7","v3.13-rc8","v3.14","v3.14-rc1","v3.14-rc2","v3.14-rc3","v3.14-rc4","v3.14-rc5","v3.14-rc6","v3.14-rc7","v3.14-rc8","v3.15","v3.15-rc1","v3.15-rc2","v3.15-rc3","v3.15-rc4","v3.15-rc5","v3.15-rc6","v3.15-rc7","v3.15-rc8","v3.16","v3.16-rc1","v3.16-rc2","v3.16-rc3","v3.16-rc4","v3.16-rc5","v3.16-rc6","v3.16-rc7","v3.17","v3.17-rc1","v3.17-rc2","v3.17-rc3","v3.17-rc4","v3.17-rc5","v3.17-rc6","v3.17-rc7","v3.18","v3.18-rc1","v3.18-rc2","v3.18-rc3","v3.18-rc4","v3.18-rc5","v3.18-rc6","v3.18-rc7","v3.19","v3.19-rc1","v3.19-rc2","v3.19-rc3","v3.19-rc4","v3.19-rc5","v3.19-rc6","v3.19-rc7","v3.2","v3.2-rc1","v3.2-rc2","v3.2-rc3","v3.2-rc4","v3.2-rc5","v3.2-rc6","v3.2-rc7","v3.3","v3.3-rc1","v3.3-rc2","v3.3-rc3","v3.3-rc4","v3.3-rc5","v3.3-rc6","v3.3-rc7","v3.4","v3.4-rc1","v3.4-rc2","v3.4-rc3","v3.4-rc4","v3.4-rc5","v3.4-rc6","v3.4-rc7","v3.5","v3.5-rc1","v3.5-rc2","v3.5-rc3","v3.5-rc4","v3.5-rc5","v3.5-rc6","v3.5-rc7","v3.6","v3.6-rc1","v3.6-rc2","v3.6-rc3","v3.6-rc4","v3.6-rc5","v3.6-rc6","v3.6-rc7","v3.7","v3.7-rc1","v3.7-rc2","v3.7-rc3","v3.7-rc4","v3.7-rc5","v3.7-rc6","v3.7-rc7","v3.7-rc8","v3.8","v3.8-rc1","v3.8-rc2","v3.8-rc3","v3.8-rc4","v3.8-rc5","v3.8-rc6","v3.8-rc7","v3.9","v3.9-rc1","v3.9-rc2","v3.9-rc3","v3.9-rc4","v3.9-rc5","v3.9-rc6","v3.9-rc7","v3.9-rc8","v4.0","v4.0-rc1","v4.0-rc2","v4.0-rc3","v4.0-rc4","v4.0-rc5","v4.0-rc6","v4.0-rc7","v4.1","v4.1-rc1","v4.1-rc2","v4.1-rc3","v4.1-rc4","v4.1-rc5","v4.1-rc6","v4.1-rc7","v4.1-rc8","v4.10","v4.10-rc1","v4.10-rc2","v4.10-rc3","v4.10-rc4","v4.10-rc5","v4.10-rc6","v4.10-rc7","v4.10-rc8","v4.11","v4.11-rc1","v4.11-rc2","v4.11-rc3","v4.11-rc4","v4.11-rc5","v4.11-rc6","v4.11-rc7","v4.11-rc8","v4.12","v4.12-rc1","v4.12-rc2","v4.12-rc3","v4.12-rc4","v4.12-rc5","v4.12-rc6","v4.12-rc7","v4.13","v4.13-rc1","v4.13-rc2","v4.13-rc3","v4.13-rc4","v4.13-rc5","v4.13-rc6","v4.13-rc7","v4.14","v4.14-rc1","v4.14-rc2","v4.14-rc3","v4.14-rc4","v4.14-rc5","v4.14-rc6","v4.14-rc7","v4.14-rc8","v4.15","v4.15-rc1","v4.15-rc2","v4.15-rc3","v4.15-rc4","v4.15-rc5","v4.15-rc6","v4.15-rc7","v4.15-rc8","v4.15-rc9","v4.16","v4.16-rc1","v4.16-rc2","v4.16-rc3","v4.16-rc4","v4.16-rc5","v4.16-rc6","v4.16-rc7","v4.17","v4.17-rc1","v4.17-rc2","v4.17-rc3","v4.17-rc4","v4.17-rc5","v4.17-rc6","v4.17-rc7","v4.18","v4.18-rc1","v4.18-rc2","v4.18-rc3","v4.18-rc4","v4.18-rc5","v4.18-rc6","v4.18-rc7","v4.18-rc8","v4.19-rc1","v4.19-rc2","v4.19-rc3","v4.2","v4.2-rc1","v4.2-rc2","v4.2-rc3","v4.2-rc4","v4.2-rc5","v4.2-rc6","v4.2-rc7","v4.2-rc8","v4.3","v4.3-rc1","v4.3-rc2","v4.3-rc3","v4.3-rc4","v4.3-rc5","v4.3-rc6","v4.3-rc7","v4.4","v4.4-rc1","v4.4-rc2","v4.4-rc3","v4.4-rc4","v4.4-rc5","v4.4-rc6","v4.4-rc7","v4.4-rc8","v4.5","v4.5-rc1","v4.5-rc2","v4.5-rc3","v4.5-rc4","v4.5-rc5","v4.5-rc6","v4.5-rc7","v4.6","v4.6-rc1","v4.6-rc2","v4.6-rc3","v4.6-rc4","v4.6-rc5","v4.6-rc6","v4.6-rc7","v4.7","v4.7-rc1","v4.7-rc2","v4.7-rc3","v4.7-rc4","v4.7-rc5","v4.7-rc6","v4.7-rc7","v4.8","v4.8-rc1","v4.8-rc2","v4.8-rc3","v4.8-rc4","v4.8-rc5","v4.8-rc6","v4.8-rc7","v4.8-rc8","v4.9","v4.9-rc1","v4.9-rc2","v4.9-rc3","v4.9-rc4","v4.9-rc5","v4.9-rc6","v4.9-rc7","v4.9-rc8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-17182.json","unresolved_ranges":[{"events":[{"introduced":"3.16"},{"fixed":"3.16.58"}]},{"events":[{"introduced":"3.17"},{"fixed":"3.18.123"}]},{"events":[{"introduced":"3.19"},{"fixed":"4.4.157"}]},{"events":[{"introduced":"4.5"},{"fixed":"4.9.128"}]},{"events":[{"introduced":"4.10"},{"fixed":"4.14.71"}]},{"events":[{"introduced":"4.15"},{"fixed":"4.18.9"}]},{"events":[{"introduced":"0"},{"last_affected":"14.04"}]},{"events":[{"introduced":"0"},{"last_affected":"16.04"}]},{"events":[{"introduced":"0"},{"last_affected":"18.04"}]},{"events":[{"introduced":"0"},{"last_affected":"8.0"}]},{"events":[{"introduced":"0"},{"last_affected":"9.0"}]},{"events":[{"introduced":"0"},{"last_affected":"4.18.8."}]}],"vanir_signatures_modified":"2026-04-11T12:27:55Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["240124024396439504439803766782600832064","21059909105136678033621148383106719880","154154986865702304987939752280629165228","162471613048001888403654497079176542413","192333891268079154172687866068090318066","286806580424062801940934913028227711127","67314702419112730946684371173449540551","39910229674193220632443931151898107875","279966586834762827279875429252078786627","178713943606386439007039516395447798341","286094482447005461567487654892337246762","199599749797696848752992938147483229217","329297520795150354595621835685988853273","96643175498075856721837589001209984352","102833462443920232392518221328215597565","82540962685744743942056219381147613769"],"threshold":0.9},"id":"CVE-2018-17182-18b54ab5","signature_type":"Line","signature_version":"v1","source":"https://github.com/torvalds/linux/commit/7a9cdebdcc17e426fb5287e4a82db1dfe86339b2","target":{"file":"mm/vmacache.c"}},{"source":"https://github.com/torvalds/linux/commit/7a9cdebdcc17e426fb5287e4a82db1dfe86339b2","target":{"file":"include/linux/vm_event_item.h"},"deprecated":false,"digest":{"line_hashes":["236901480781999103256260770456949433716","208896353763059738388238600491551412809","268443966611436317190529863525677094404","6859263621035147719017840809568614405"],"threshold":0.9},"id":"CVE-2018-17182-2e1435d6","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"117443267997079709498573459127511420058","length":2104},"id":"CVE-2018-17182-3bdc1df5","signature_type":"Function","signature_version":"v1","source":"https://github.com/torvalds/linux/commit/7a9cdebdcc17e426fb5287e4a82db1dfe86339b2","target":{"file":"mm/debug.c","function":"dump_mm"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/torvalds/linux/commit/7a9cdebdcc17e426fb5287e4a82db1dfe86339b2","target":{"file":"include/linux/vmacache.h","function":"vmacache_invalidate"},"deprecated":false,"digest":{"function_hash":"340180495965527980785898035930168444503","length":151},"id":"CVE-2018-17182-81bb4a8b","signature_type":"Function"},{"source":"https://github.com/torvalds/linux/commit/7a9cdebdcc17e426fb5287e4a82db1dfe86339b2","target":{"file":"include/linux/mm_types_task.h"},"deprecated":false,"digest":{"line_hashes":["221241490687123560875667623694242161819","62741813222907544133702910539061606848","240513543511403637068503273723827415808","75528007170416660885941994288626984607"],"threshold":0.9},"id":"CVE-2018-17182-8d881016","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/torvalds/linux/commit/7a9cdebdcc17e426fb5287e4a82db1dfe86339b2","target":{"file":"mm/debug.c"},"deprecated":false,"digest":{"line_hashes":["185964673056050150984519946959341168318","266068693516038611360725618386551471346","143220755729447905005798851434285648416","102067439735930741349880842356910086549","295709339822372100717705749059255841723","51784506300485430071838244179287770190","178806048513478994461581473674614850804","165160953742891526946796780161039938243"],"threshold":0.9},"id":"CVE-2018-17182-a0b90975","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/torvalds/linux/commit/7a9cdebdcc17e426fb5287e4a82db1dfe86339b2","target":{"file":"include/linux/vmacache.h"},"deprecated":false,"digest":{"line_hashes":["285601519453822061422654771777220466023","249640438434279102729558271899399160090","184443319641665932983425703766778814363","24001680737419618739535065760536965576","165941140460747395271876155711306920912","95192391830139623034201478175336679964","52681005502512929987595387678197094638","89511198294478524485407952491524136094"],"threshold":0.9},"id":"CVE-2018-17182-c26cd80e"},{"digest":{"line_hashes":["333132300510272803561971868881147864186","24187826790172754131596617378930317362","153212594765614045872250466950086837077","128432082023139094394643791719536656745"],"threshold":0.9},"id":"CVE-2018-17182-d8e98713","signature_type":"Line","signature_version":"v1","source":"https://github.com/torvalds/linux/commit/7a9cdebdcc17e426fb5287e4a82db1dfe86339b2","target":{"file":"include/linux/mm_types.h"},"deprecated":false},{"id":"CVE-2018-17182-f23fe589","signature_type":"Function","signature_version":"v1","source":"https://github.com/torvalds/linux/commit/7a9cdebdcc17e426fb5287e4a82db1dfe86339b2","target":{"file":"mm/vmacache.c","function":"vmacache_flush_all"},"deprecated":false,"digest":{"function_hash":"162117403141697220560666191897487691340","length":269}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}