net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0 does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Nov 16, 2015 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | May 17, 2016 | Nov 16, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 23, 2015 |
| Suse | — | Upgrade kernel-ec2-extraUpgrade kernel-docsUpgrade kernel-defaultUpgrade kernel-ec2-develUpgrade kernel-ec2Upgrade kernel-obs-build | Dec 18, 2015 | Nov 16, 2015 |
| Ubuntu | — | Upgrade linuxUpgrade linux-lts-utopicUpgrade linux-armadaxpUpgrade linux-lts-vividUpgrade linux-ti-omap4Upgrade linux-raspi2Upgrade linux-lts-trusty | Nov 19, 2024 | Nov 16, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub