CVE-2016-4482

medium

Published 2016-05-23 · Modified 2026-05-06

CVSS v3

6.2

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2

2.1

VIR risk

6.2

Description

The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call.

Predictions

Exploit likelihood

62%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2016-4482

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://github.com/torvalds/linux/commit/681fef8380eb818c0b845fca5d2ab1dcbab114ee

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=681fef8380eb818c0b845fca5d2ab1dcbab114ee

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2016-4482.html

OS impact

OS	Version	Status	Fixed in
sles		affected
ubuntu	12.04	affected
ubuntu	14.04	affected
ubuntu	15.10	affected
ubuntu	16.04	affected
suse	11.0	affected
suse	12.0	affected
fedora	24	affected
linux-kernel		affected
debian	bookworm	fixed	`4.5.5-1`
debian	bullseye	fixed	`4.5.5-1`
debian	forky	fixed	`4.5.5-1`
debian	sid	fixed	`4.5.5-1`
debian	trixie	fixed	`4.5.5-1`

Application impact

Vendor	Product	Versions	Fixed
novell	suse_linux_enterprise_software_development_kit	`11.0`
novell	suse_linux_enterprise_software_development_kit	`12.0`

References

CWEs

CWE-200

Verify integrity in audit chain (admin only). AS-IS.