CVE-2016-10741

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON instead of an I/O failure.

Metrics

CVSS 3.0 4.7/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Feb 1, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-107426.1Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect viCVE-2016-107437.5hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.CVE-2016-107446.1In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data lCVE-2016-107458.6In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.CVE-2016-107467.5libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connecCVE-2016-107499.8parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and enCVE-2016-10759.8Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and AcroCVE-2016-107508.1In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reaCVE-2016-107517.2osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution beCVE-2016-107529.8serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles aCVE-2016-107538.8e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC.CVE-2016-107548.8modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection via the contactidlist parameter.