Security readout for executives and security teams
Plain-English summary
This CVE describes a Linux kernel denial-of-service condition. A local unprivileged user could cause a system to lock up indefinitely when the global out-of-memory killer is invoked. The source bundle does not show active exploitation, a CVSS score, or an accepted upstream fix.
Executive priority
Treat this as an operational availability risk, especially for shared Linux infrastructure. It should not outrank remotely exploitable issues, but potentially affected multi-user systems deserve focused review and vendor-guided remediation.
Technical view
In Linux kernels through 4.17.2, the page allocator may fail to yield CPU resources to the holder of the oom_lock mutex. During global OOM handling, concurrent page-fault-driven allocation pressure can keep the system stuck, creating a local denial of service.
Likely exposure
Exposure is most relevant to Linux systems running kernels through 4.17.2 where unprivileged local users or workloads can execute code. Shared servers, multi-user systems, and environments with untrusted local workloads have higher practical risk.
Exploitation context
The public description supports local unprivileged denial of service, not remote compromise or data theft. CISA KEV status is false in the provided bundle, and no cited source states active exploitation in the wild.
Researcher notes
Evidence is incomplete on accepted fixes. The CVE notes proposed patches and maintainer concern that the underlying issue is non-trivial. Avoid assuming a universal patch; validate against specific vendor kernel backports and advisories.
Mitigation direction
- Inventory Linux kernel versions and flag systems through 4.17.2.
- Check distribution or vendor advisories for CVE-2016-10723 guidance.
- Prioritize shared systems with untrusted local users or workloads.
- Reduce untrusted local access on potentially affected hosts.
- Review memory-pressure controls for workloads that can trigger global OOM.
Validation and detection
- Confirm kernel versions on Linux hosts against the affected range.
- Identify hosts allowing unprivileged local shell or workload execution.
- Check vendor kernel changelogs for explicit CVE or OOM-lock handling references.
- Review monitoring for unexplained OOM-related hangs or lockups.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2016-10723 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://patchwork.kernel.org/patch/9842889/CVE reference · x_refsource_MISC
- https://www.spinics.net/lists/linux-mm/msg117896.htmlCVE reference · x_refsource_MISC
- https://patchwork.kernel.org/patch/10395909/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.