$ cve CVE-2016-3136 JSON

CVE-2016-3136 EXPLOIT

4.6

MEDIUM · CVSS 3.0 · EPSS 1.8% (pctl 78)

Patch early

A public exploit exists.

Description

The mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device without two interrupt-in endpoint descriptors.

Scoring

CVSS	4.6 (MEDIUM, v3.0)
Vector	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS	1.8% — more likely to be exploited than 78% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2016-05-02
Last modified	2026-06-17

Affected (9)

Vendor	Product
canonical	ubuntu linux
linux	linux kernel
novell	suse linux enterprise desktop
novell	suse linux enterprise live patching
novell	suse linux enterprise module for public cloud
novell	suse linux enterprise real time extension
novell	suse linux enterprise server
novell	suse linux enterprise software development kit
novell	suse linux enterprise workstation extension

Public exploits

Source	Title	Date
exploit-db	Linux Kernel 3.10.0 (CentOS / RHEL 7.1) - 'mct_u232' Nullpointer Dereference	2016-03-09

References

→ the Explorer · watch your stack · NVD