Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2016-6828

23
FAUCET Score

CVE-2016-6828 is a use-after-free vulnerability in the tcp_check_send_head function of the Linux kernel (before version 4.7.5), allowing local users to cause a denial of service (system crash) via a crafted SACK option. It has a CVSS score of 5.5 (Medium), indicating a local attack vector with low complexity and a high impact on availability. While not actively exploited in the wild, public exploit code exists (EDB-40731), and it has received some community discussion and media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
<= 4.7.4CPE matchmatch criteria
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

5.5MEDIUM

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
3.6
CvssVersion
3.0

Exploit Intelligence

EPSS Score
1.18%
Probability of exploitation in next 30 days
EPSS Percentile
64.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
ExploitDB: EDB-40731 · Aug 18, 2016
This CVE's current EPSS score of 0.0118 is in the 97th percentile among its peer group of 15,938 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

github_advisorypatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: kernel-0:2.6.32-642.13.1.el6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: kernel-rt-0:3.10.0-514.6.1.rt56.429.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: kernel-0:3.10.0-514.6.1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise MRG 2Fixed in: kernel-rt-1:3.10.0-514.rt56.210.el6rt
View patch
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: kernel

Vendor Advisories (1)

redhatCVE-2016-6828Moderate

kernel: Use after free in tcp_xmit_retransmit_queue

Aug 15, 2016

References

git.kernel.org / cgit/linux/kernel/git/torvalds/linux.git/commit
Issue TrackingPatch
rhn.redhat.com / errata/RHSA-2017-0036.html
rhn.redhat.com / errata/RHSA-2017-0086.html
rhn.redhat.com / errata/RHSA-2017-0091.html
rhn.redhat.com / errata/RHSA-2017-0113.html
bugzilla.redhat.com / show_bug.cgi
Issue TrackingThird Party Advisory
github.com / torvalds/linux/commit/bb1fceca22492109be12640d49f5ea5a544c6bb4
Issue TrackingPatch
marcograss.github.io / security/linux/2016/08/18/cve-2016-6828-linux-kernel-tcp-uaf.html
source.android.com / security/bulletin/2016-11-01.html
kernel.org / pub/linux/kernel/v4.x/ChangeLog-4.7.5
Release NotesThird Party Advisory
openwall.com / lists/oss-security/2016/08/15/1
ExploitThird Party Advisory
securityfocus.com / bid/92452