CVE-2016-3138: The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically pr...

Security readout for executives and security teams

CVE-2016-3138 is a Linux kernel denial-of-service flaw triggered by a malformed USB CDC ACM device. An attacker needs physical proximity to plug in or present a crafted USB device. Successful exploitation can crash the system, causing downtime, but the provided sources do not indicate remote code execution or active exploitation. Systems running affected Linux kernels with accessible USB ports and the cdc-acm driver path are the primary concern. Exposure is lower for locked-down servers without physical USB access. Distribution-specific exposure should be checked against Ubuntu, SUSE/openSUSE, Debian, Red Hat, or other vendor kernel advisories. Treat this as a targeted availability risk, not a broad internet-exposed emergency. Prioritize shared workstations, kiosks, labs, and servers with accessible USB ports. Routine kernel patching and physical access controls should sufficiently manage most enterprise exposure. Mitigation focus: Apply vendor-provided kernel updates that include the upstream fix for CVE-2016-3138.; Prioritize systems with user-accessible USB ports or weak physical access controls.; Restrict physical access to USB ports on sensitive Linux systems..

Prepared

Jun 13, 2026, 19:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.