CVE-2016-10150: Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux ke...

Security readout for executives and security teams

CVE-2016-10150 is a Linux kernel KVM memory-safety flaw. A local host user with access to KVM could crash the host, and the CVE notes possible privilege gain. For organizations running virtualization hosts, the main business concern is host stability and isolation risk. Exposure is most likely on Linux systems using KVM with kernels before 4.8.13, or vendor kernels lacking the backported fix. Risk increases where non-administrative users, tenants, or services can access /dev/kvm. Treat this as important for virtualization infrastructure, especially shared hosts. It is not evidenced as actively exploited, but a host crash or possible privilege gain can affect availability and isolation. Mitigation focus: Update to a kernel containing the upstream KVM fix or vendor backport.; Check distribution advisories before relying on raw kernel version numbers.; Restrict /dev/kvm access to trusted users and services only..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.