What is CVE-2016-9644?

CVE-2016-9644 is a high-severity vulnerability in Linux Kernel, classified under CWE-264. CVSS score: 7.8/10. Published 2016-11-28.

How severe is CVE-2016-9644?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Linux Kernel

CVE-2016-9644

The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table, which allows local users to obtain root access on non-SMEP platforms via a crafted application. NOTE: this vulnerability exists because of incorrect backporting of the CVE-2016-9178 patch to older kernels.

Published 2016-11-28 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.015 (72.5th percentile), scored 2026-10-02.

Low probability of exploitation in the next 30 days, but still tracked. 72nd percentile — 72.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000

Affected products

Linux Kernel — versions 4.4.22, 4.4.23, 4.4.24

Weakness classification (CWE)

CWE-264

References

www.ubuntu.com/usn/USN-3146-2 (vendor-advisory)
www.securityfocus.com/bid/94545 (vdb-entry)
www.ubuntu.com/usn/USN-3146-1 (vendor-advisory)
www.openwall.com/lists/oss-security/2016/11/07/4 (mailing-list, Mailing List, Third Party Advisory)
lwn.net/Articles/705220/ (Product)

Frequently asked questions

What is CVE-2016-9644?: CVE-2016-9644 is a high-severity vulnerability in Linux Kernel, classified under CWE-264. CVSS score: 7.8/10. Published 2016-11-28.
How severe is CVE-2016-9644?: High severity. CVSS v3 base score is 7.8 out of 10.