What is CVE-2017-15868?

CVE-2017-15868 is a high-severity vulnerability in Linux Kernel, classified under Improper Input Validation. CVSS score: 7.8/10. Published 2017-12-05.

How severe is CVE-2017-15868?

High severity. CVSS v3 base score is 7.8 out of 10.

Improper input validation in Linux Kernel

CVE-2017-15868

The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not ensure that an l2cap socket is available, which allows local users to gain privileges via a crafted application.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2017-12-05 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.004 (35.6th percentile), scored 2026-10-07.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 35.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

Linux Kernel
Canonical Ubuntu Linux — versions 12.04, 14.04
Debian Linux — versions 8.0

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

www.debian.org/security/2018/dsa-4082 (vendor-advisory, Third Party Advisory)
lists.debian.org/debian-lts-announce/2017/12/msg00004.html (mailing-list, Mailing List, Third Party Advisory)
git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/ (Patch, Vendor Advisory)
usn.ubuntu.com/3583-2/ (vendor-advisory, Third Party Advisory)
lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html (vendor-advisory, Mailing List, Third Party Advisory)
usn.ubuntu.com/3583-1/ (vendor-advisory, Third Party Advisory)
source.android.com/security/bulletin/pixel/2017-12-01 (Third Party Advisory)
patchwork.kernel.org/patch/9882449/ (Patch, Vendor Advisory)
github.com/torvalds/linux/commit/71bb99a02b32b4cc4265118e85f6035ca72923f0 (Issue Tracking)
www.securityfocus.com/bid/102084 (VDB Entry, Third Party Advisory, vdb-entry)

Frequently asked questions

What is CVE-2017-15868?: CVE-2017-15868 is a high-severity vulnerability in Linux Kernel, classified under Improper Input Validation. CVSS score: 7.8/10. Published 2017-12-05.
How severe is CVE-2017-15868?: High severity. CVSS v3 base score is 7.8 out of 10.