{"api_version":"1","generated_at":"2026-07-23T03:12:38+00:00","cve":"CVE-2016-8666","urls":{"html":"https://cve.report/CVE-2016-8666","api":"https://cve.report/api/cve/CVE-2016-8666.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-8666","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-8666"},"summary":{"title":"CVE-2016-8666","description":"The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039.","state":"PUBLISHED","assigner":"microfocus","published_at":"2016-10-16 21:59:15","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-400","n/a"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.8","severity":"","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:C","baseScore":7.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2017-0004.html","name":"http://rhn.redhat.com/errata/RHSA-2017-0004.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2017:0372","name":"https://access.redhat.com/errata/RHSA-2017:0372","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal - Access to 24x7 support and knowledge","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2107.html","name":"http://rhn.redhat.com/errata/RHSA-2016-2107.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2047.html","name":"http://rhn.redhat.com/errata/RHSA-2016-2047.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://github.com/torvalds/linux/commit/fac8e0f579695a3ecbc4d3cac369139d7f819971","name":"https://github.com/torvalds/linux/commit/fac8e0f579695a3ecbc4d3cac369139d7f819971","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"tunnels: Don't apply GRO to multiple layers of encapsulation. · torvalds/linux@fac8e0f · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1384991","name":"https://bugzilla.redhat.com/show_bug.cgi?id=1384991","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Bug 1384991 – CVE-2016-8666 kernel: Remotely triggerable recursion in GRE code leading to kernel crash","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/93562","name":"http://www.securityfocus.com/bid/93562","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Linux Kernel CVE-2016-8666 Stack Overflow Denial of Service Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fac8e0f579695a3ecbc4d3cac369139d7f819971","name":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fac8e0f579695a3ecbc4d3cac369139d7f819971","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"kernel/git/torvalds/linux.git - Linux kernel source tree","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2016/10/13/11","name":"http://www.openwall.com/lists/oss-security/2016/10/13/11","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - CVE Request: another recursion in GRE","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1001486","name":"https://bugzilla.suse.com/show_bug.cgi?id=1001486","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Bug 1001486 – VUL-0: CVE-2016-7039, CVE-2016-8666: kernel-source: remote crash via stack overflow","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2110.html","name":"http://rhn.redhat.com/errata/RHSA-2016-2110.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://bto.bluecoat.com/security-advisory/sa134","name":"https://bto.bluecoat.com/security-advisory/sa134","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Broadcom Support Portal","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8666","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8666","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"8666","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T02:27:41.223Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"RHSA-2016:2107","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2016-2107.html"},{"name":"RHSA-2017:0372","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2017:0372"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bto.bluecoat.com/security-advisory/sa134"},{"name":"93562","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/93562"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fac8e0f579695a3ecbc4d3cac369139d7f819971"},{"name":"RHSA-2016:2047","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2016-2047.html"},{"name":"RHSA-2016:2110","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2016-2110.html"},{"name":"[oss-security] 20161013 CVE Request: another recursion in GRE","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2016/10/13/11"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/torvalds/linux/commit/fac8e0f579695a3ecbc4d3cac369139d7f819971"},{"name":"RHSA-2017:0004","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2017-0004.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1384991"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.suse.com/show_bug.cgi?id=1001486"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2016-09-27T00:00:00.000Z","descriptions":[{"lang":"en","value":"The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2021-01-06T16:16:08.000Z","orgId":"f81092c5-7f14-476d-80dc-24857f90be84","shortName":"microfocus"},"references":[{"name":"RHSA-2016:2107","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2016-2107.html"},{"name":"RHSA-2017:0372","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2017:0372"},{"tags":["x_refsource_CONFIRM"],"url":"https://bto.bluecoat.com/security-advisory/sa134"},{"name":"93562","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/93562"},{"tags":["x_refsource_CONFIRM"],"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fac8e0f579695a3ecbc4d3cac369139d7f819971"},{"name":"RHSA-2016:2047","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2016-2047.html"},{"name":"RHSA-2016:2110","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2016-2110.html"},{"name":"[oss-security] 20161013 CVE Request: another recursion in GRE","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2016/10/13/11"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/torvalds/linux/commit/fac8e0f579695a3ecbc4d3cac369139d7f819971"},{"name":"RHSA-2017:0004","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2017-0004.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1384991"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.suse.com/show_bug.cgi?id=1001486"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@microfocus.com","ID":"CVE-2016-8666","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"RHSA-2016:2107","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2016-2107.html"},{"name":"RHSA-2017:0372","refsource":"REDHAT","url":"https://access.redhat.com/errata/RHSA-2017:0372"},{"name":"https://bto.bluecoat.com/security-advisory/sa134","refsource":"CONFIRM","url":"https://bto.bluecoat.com/security-advisory/sa134"},{"name":"93562","refsource":"BID","url":"http://www.securityfocus.com/bid/93562"},{"name":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fac8e0f579695a3ecbc4d3cac369139d7f819971","refsource":"CONFIRM","url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fac8e0f579695a3ecbc4d3cac369139d7f819971"},{"name":"RHSA-2016:2047","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2016-2047.html"},{"name":"RHSA-2016:2110","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2016-2110.html"},{"name":"[oss-security] 20161013 CVE Request: another recursion in GRE","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2016/10/13/11"},{"name":"https://github.com/torvalds/linux/commit/fac8e0f579695a3ecbc4d3cac369139d7f819971","refsource":"CONFIRM","url":"https://github.com/torvalds/linux/commit/fac8e0f579695a3ecbc4d3cac369139d7f819971"},{"name":"RHSA-2017:0004","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2017-0004.html"},{"name":"https://bugzilla.redhat.com/show_bug.cgi?id=1384991","refsource":"CONFIRM","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1384991"},{"name":"https://bugzilla.suse.com/show_bug.cgi?id=1001486","refsource":"CONFIRM","url":"https://bugzilla.suse.com/show_bug.cgi?id=1001486"}]}}}},"cveMetadata":{"assignerOrgId":"f81092c5-7f14-476d-80dc-24857f90be84","assignerShortName":"microfocus","cveId":"CVE-2016-8666","datePublished":"2016-10-16T21:00:00.000Z","dateReserved":"2016-10-14T00:00:00.000Z","dateUpdated":"2024-08-06T02:27:41.223Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2016-10-16 21:59:15","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-400","n/a"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:C","baseScore":7.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"3.16.35","matchCriteriaId":"94939292-97B9-46BE-BF06-57D0DB7A8904"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.17","versionEndExcluding":"3.18.47","matchCriteriaId":"B1A82714-1C53-498D-94AA-DE9F6B577522"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.19","versionEndExcluding":"4.1.38","matchCriteriaId":"755C626E-7669-4E6E-BC91-2656E4740E66"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2","versionEndExcluding":"4.4.29","matchCriteriaId":"D23F7205-D265-429A-ACA9-F0FDAA8615A1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"4.6","matchCriteriaId":"628AFDA5-6C82-4DB8-8280-D1D7C58BBFE7"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"8666","Ordinal":"1","Title":"CVE-2016-8666","CVE":"CVE-2016-8666","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"8666","Ordinal":"1","NoteData":"The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039.","Type":"Description","Title":"CVE-2016-8666"},{"CveYear":"2016","CveId":"8666","Ordinal":"2","NoteData":"2016-10-16","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"8666","Ordinal":"3","NoteData":"2021-01-06","Type":"Other","Title":"Modified"}]}}}