What is CVE-2014-9710?

CVE-2014-9710 is a vulnerability in Linux Kernel, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). Published 2015-05-27.

Is CVE-2014-9710 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Linux Kernel

CVE-2014-9710

The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit.

Vulnerability class: Race Condition

Published 2015-05-27 · last modified 2026-06-17.

CVSS v2 metric

CVSS v2 base score 6.9 (Medium). Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.003 (18.3th percentile), scored 2026-10-03.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 18th percentile — 18.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

Linux Kernel

Weakness classification (CWE)

CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

Public proof-of-concept exploits

References

git.kernel.org/ (Broken Link, Vendor Advisory)
lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html (vendor-advisory, Mailing List, Third Party Advisory)
bugzilla.redhat.com/show_bug.cgi (Third Party Advisory, Issue Tracking)
www.securitytracker.com/id/1032418 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
www.openwall.com/lists/oss-security/2015/03/24/11 (mailing-list, Mailing List)
lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html (vendor-advisory, Mailing List, Third Party Advisory)
github.com/torvalds/linux/commit/5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339 (Patch)

Frequently asked questions

What is CVE-2014-9710?: CVE-2014-9710 is a vulnerability in Linux Kernel, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). Published 2015-05-27.
Is CVE-2014-9710 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.