Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2016-2854

36
FAUCET Score

CVE-2016-2854 describes a privilege escalation vulnerability in the aufs module of Linux kernel versions 3.x and 4.x. This flaw allows local users to gain elevated privileges by exploiting improper handling of POSIX ACL xattr data within group-writable setgid directories. With a CVSS score of 7.8 (High), successful exploitation grants high confidentiality, integrity, and availability impacts with low attack complexity. While not observed in active exploitation (KEV: No), public exploit code exists, specifically targeting Ubuntu 15.10, though community discussion and media coverage remain minimal.

Impacted Technologies

VendorProductVersion(s)CPE
>= 3.0.0, <= 3.19.8CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
>= 4.0.0, <= 4.20.15CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.8HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.95%
Probability of exploitation in next 30 days
EPSS Percentile
57.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
ExploitDB: EDB-41761 · Feb 19, 2016
This CVE's current EPSS score of 0.0095 is in the 91st percentile among its peer group of 17,061 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Advisories (1)

redhatCVE-2016-2854

kernel: aufs module does not properly maintain POSIX ACL xattr data

Feb 24, 2016

References

sourceforge.net / p/aufs/mailman/message/34864744
Third Party Advisory
halfdog.net / Security/2016/AufsPrivilegeEscalationInUserNamespaces
ExploitThird Party Advisory
openwall.com / lists/oss-security/2016/02/24/9
ExploitMailing ListThird Party Advisory
securityfocus.com / bid/96838
Third Party AdvisoryVDB Entry