Skip to content
Fencer Vulns
medium 4.7

CVE-2018-16885 json

A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and b…

published 2019-01-03 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-8675

cvss
4.7
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits
0
none known

Summary

A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and buffer length which causes the read beyond the buffer boundaries, in certain cases causing a memory access fault and a system halt by accessing invalid memory address. This issue only affects kernel version 3.10.x as shipped with Red Hat Enterprise Linux 7.

Patch / fix

  • linux Debian 14, Debian 13, Debian 12 3.16.2-1

debian advisories DEBIAN-CVE-2018-16885

  • kernel RHEL 7 3.10.0-1062.el7
  • perf RHEL 7 3.10.0-1062.el7
  • bpftool RHEL 7 3.10.0-1062.el7
  • python-perf RHEL 7 3.10.0-1062.el7
  • kernel-kdump RHEL 7 3.10.0-1062.el7
  • kernel-tools RHEL 7 3.10.0-1062.el7
  • kernel-tools-libs RHEL 7 3.10.0-1062.el7
  • kernel-bootwrapper RHEL 7 3.10.0-1062.el7

red hat advisories RHSA-2026:14925RHSA-2026:14869RHSA-2026:14823RHSA-2019:2029RHSA-2019:2043

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-16885 updated cvss 7.1

kernel: out-of-bound read in memcpy_fromiovecend()

  • Red Hat Enterprise Linux 5 kernel Red Hat Enterprise MRG 2 kernel-rt, mrg-rt-release, kernel-rt-trace, kernel-rt-vanilla, kernel-rt-firmware
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-1062.el7, kernel 3.10.0-1062.el7, bpftool 3.10.0-1062.el7, python-perf 3.10.0-1062.el7, kernel-tools 3.10.0-1062.el7, kernel-tools-libs 3.10.0-1062.el7, +2 more Red Hat Enterprise Linux Client Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1062.el7 Red Hat Enterprise Linux ComputeNode (v. 7) perf 3.10.0-1062.el7, kernel 3.10.0-1062.el7, bpftool 3.10.0-1062.el7, python-perf 3.10.0-1062.el7, kernel-tools 3.10.0-1062.el7, kernel-tools-libs 3.10.0-1062.el7, +2 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1062.el7
    fixed: vendor fix RHSA-2019:2029
  • Red Hat Enterprise Linux for Real Time (v. 7 ELS) kernel-rt 3.10.0-1160.149.1.rt56.1301.el7, kernel-rt-trace 3.10.0-1160.149.1.rt56.1301.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1160.149.1.rt56.1301.el7
    fixed: vendor fix RHSA-2026:14869
  • Red Hat Enterprise Linux for Real Time (v. 7) kernel-rt 3.10.0-1062.rt56.1022.el7, kernel-rt-trace 3.10.0-1062.rt56.1022.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1062.rt56.1022.el7 Red Hat Enterprise Linux for Real Time for NFV (v. 7) kernel-rt 3.10.0-1062.rt56.1022.el7, kernel-rt-kvm 3.10.0-1062.rt56.1022.el7, kernel-rt-trace 3.10.0-1062.rt56.1022.el7, kernel-rt-debug-kvm 3.10.0-1062.rt56.1022.el7, kernel-rt-trace-kvm 3.10.0-1062.rt56.1022.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1062.rt56.1022.el7
    fixed: vendor fix RHSA-2019:2043
  • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) perf 2.6.32-754.60.1.el6, kernel 2.6.32-754.60.1.el6, kernel-kdump 2.6.32-754.60.1.el6, kernel-firmware 2.6.32-754.60.1.el6, kernel-abi-whitelists 2.6.32-754.60.1.el6, kernel-debuginfo-common-i686 2.6.32-754.60.1.el6, +2 more
    fixed: vendor fix RHSA-2026:14823
  • Red Hat Enterprise Linux Server (v. 7 ELS) perf 3.10.0-1160.149.1.el7, kernel 3.10.0-1160.149.1.el7, bpftool 3.10.0-1160.149.1.el7, python-perf 3.10.0-1160.149.1.el7, kernel-kdump 3.10.0-1160.149.1.el7, kernel-tools 3.10.0-1160.149.1.el7, +7 more
    fixed: vendor fix RHSA-2026:14925
  • Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-1062.el7, kernel 3.10.0-1062.el7, bpftool 3.10.0-1062.el7, python-perf 3.10.0-1062.el7, kernel-kdump 3.10.0-1062.el7, kernel-tools 3.10.0-1062.el7, +7 more
    fixed: vendor fix RHSA-2019:2029
  • Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) python-perf 2.6.32-754.60.1.el6, kernel-debuginfo-common-i686 2.6.32-754.60.1.el6, kernel-debuginfo-common-s390x 2.6.32-754.60.1.el6, kernel-debuginfo-common-x86_64 2.6.32-754.60.1.el6
    fixed: vendor fix RHSA-2026:14823
show 3 more
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS) kernel-debuginfo-common-ppc64 3.10.0-1160.149.1.el7, kernel-debuginfo-common-x86_64 3.10.0-1160.149.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-1160.149.1.el7
    fixed: vendor fix RHSA-2026:14925
  • Red Hat Enterprise Linux Server Optional (v. 7) kernel-debuginfo-common-ppc64 3.10.0-1062.el7, kernel-debuginfo-common-x86_64 3.10.0-1062.el7, kernel-debuginfo-common-ppc64le 3.10.0-1062.el7 Red Hat Enterprise Linux Workstation (v. 7) perf 3.10.0-1062.el7, kernel 3.10.0-1062.el7, bpftool 3.10.0-1062.el7, python-perf 3.10.0-1062.el7, kernel-tools 3.10.0-1062.el7, kernel-tools-libs 3.10.0-1062.el7, +2 more Red Hat Enterprise Linux Workstation Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1062.el7
    fixed: vendor fix RHSA-2019:2029
  • Red Hat Enterprise Linux 7 perf, kernel, kernel-alt, python-perf, kernel-kdump, kernel-tools, +3 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 4.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.0 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C

Affected products

  • The Linux Foundation kernel

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.