CVE-2016-0728

HIGH EXPLOITED

Linux kernel <4.4.1 - Privilege Escalation/DoS

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2016-0728 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 13 public exploits from researchers including Federico Bento, Perception Point Team, nardholio.

AI-analyzed exploit summary This exploit leverages a reference counter overflow in the Linux kernel's keyring facility (CVE-2016-0728) to achieve local privilege escalation. It manipulates keyring references to trigger a use-after-free condition, overwriting kernel memory to execute arbitrary code (root shell).

Description

The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.

Exploits (13)

exploitdb WORKING POC
by Federico Bento · clocallinux
https://www.exploit-db.com/exploits/40003

This exploit leverages a reference counter overflow in the Linux kernel's keyring facility (CVE-2016-0728) to achieve local privilege escalation. It manipulates keyring references to trigger a use-after-free condition, overwriting kernel memory to execute arbitrary code (root shell).

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel < 4.4.1
No auth needed
Prerequisites: Local access to the target system · Kernel version vulnerable to CVE-2016-0728 · Ability to compile and execute the exploit
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by Perception Point Team · clocallinux
https://www.exploit-db.com/exploits/39277

This exploit leverages a reference count overflow in the Linux kernel's keyring subsystem (CVE-2016-0728) to achieve local privilege escalation by manipulating keyring references and triggering a use-after-free condition to overwrite kernel structures.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel < 4.4.1
No auth needed
Prerequisites: Local access to the target system · Kernel version vulnerable to CVE-2016-0728
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 22 stars
by nardholio · remote
https://github.com/nardholio/cve-2016-0728

This repository contains a functional exploit for CVE-2016-0728, a use-after-free vulnerability in the Linux kernel's keyring facility. The exploit leverages reference counting manipulation and message queue allocation to achieve local privilege escalation (LPE).

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel versions 3.13 through 4.4.1
No auth needed
Prerequisites: Local access to the target system · Kernel version within the affected range
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 7 stars
by bittorrent3389 · remote
https://github.com/bittorrent3389/cve-2016-0728

This repository contains a functional exploit for CVE-2016-0728, a local privilege escalation vulnerability in the Linux kernel's keyring facility. The exploit manipulates reference counters and uses a crafted key_type structure to achieve arbitrary code execution in kernel context, ultimately spawning a root shell.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (versions 3.8 through 4.4)
No auth needed
Prerequisites: Local access to the target system · Kernel version vulnerable to CVE-2016-0728
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 5 stars
by neuschaefer · dos
https://github.com/neuschaefer/cve-2016-0728-testbed

This repository contains a functional exploit PoC for CVE-2016-0728, a refcount leak and overflow bug in the Linux kernel leading to a use-after-free. The code includes a testbed to manipulate keyring refcounts, spray the heap, and achieve privilege escalation to a root shell.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (versions affected by CVE-2016-0728)
No auth needed
Prerequisites: Linux system with vulnerable kernel · ability to compile and run C code
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 3 stars
by kennetham · dos
https://github.com/kennetham/cve_2016_0728

This repository contains a functional exploit for CVE-2016-0728, a Linux kernel vulnerability involving a reference leak in keyring handling. The exploit manipulates keyring references and uses a use-after-free condition to achieve local privilege escalation by overwriting kernel structures.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux Kernel (versions 3.8 through 4.4.1)
No auth needed
Prerequisites: Local access to the target system · Kernel version vulnerable to CVE-2016-0728
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by sugarvillela · dos
https://github.com/sugarvillela/CVE

This repository contains functional exploit code for CVE-2016-0728, a local privilege escalation vulnerability in the Linux kernel's keyring subsystem. The exploit leverages an integer overflow in the keyring reference counter to achieve arbitrary code execution in kernel context.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel versions before 4.4.1 (specific distributions listed in README)
No auth needed
Prerequisites: Local access to vulnerable Linux system · Kernel version without the patch for CVE-2016-0728
devstral-2 · analyzed Feb 18, 2026 Full analysis →
gitlab WORKING POC
by dominicusin · local
https://gitlab.com/dominicusin/cve_2016_0728

This repository contains a functional exploit for CVE-2016-0728, a Linux kernel vulnerability involving a reference leak in keyring handling. The exploit manipulates keyring references and triggers a use-after-free to achieve local privilege escalation.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux Kernel (versions 3.8 through 4.4)
No auth needed
Prerequisites: Local access to the target system · Kernel version within the affected range
devstral-2 · analyzed Feb 23, 2026 Full analysis →
nomisec WORKING POC
by sidrk01 · local
https://github.com/sidrk01/cve-2016-0728

This repository contains a functional exploit for CVE-2016-0728, a use-after-free vulnerability in the Linux kernel's keyring subsystem. The exploit manipulates reference counts and triggers a race condition to achieve local privilege escalation (LPE) by overwriting kernel structures.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (versions 3.13 through 4.4.1)
No auth needed
Prerequisites: Local access to the target system · Kernel version vulnerable to CVE-2016-0728
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by tndud042713 · poc
https://github.com/tndud042713/cve

This repository provides a detailed technical analysis of CVE-2016-0728, focusing on the reference count mishandling in the `join_session_keyring` function in the Linux kernel. It includes code audits, patch analysis, and a proof-of-concept to demonstrate the vulnerability.

Classification
Writeup 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (versions before the patch)
No auth needed
Prerequisites: Access to a vulnerable Linux kernel version · Ability to compile and execute C code
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by th30d00r · poc
https://github.com/th30d00r/Linux-Vulnerability-CVE-2016-0728-and-Exploit

This repository provides a detailed analysis and references for CVE-2016-0728, a Linux kernel vulnerability. It includes links to technical writeups and exploit code but does not contain functional exploit code itself.

Classification
Writeup 90%
Attack Type
Lpe
Complexity
Moderate
Reliability
Theoretical
Target: Linux Kernel (versions prior to 4.4.1)
No auth needed
Prerequisites: Access to a vulnerable Linux system · Local user privileges
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by hal0taso · poc
https://github.com/hal0taso/CVE-2016-0728

This repository contains functional exploit code for CVE-2016-0728, a use-after-free vulnerability in the Linux kernel's keyring subsystem. The exploit demonstrates privilege escalation by manipulating keyring references and triggering a use-after-free condition.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel 3.8 to 4.4
No auth needed
Prerequisites: Linux kernel version 3.8 to 4.4 · Keyutils library
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by googleweb · dos
https://github.com/googleweb/CVE-2016-0728

This repository contains a functional exploit for CVE-2016-0728, a use-after-free vulnerability in the Linux kernel's keyring handling. The exploit manipulates keyring references and message queues to achieve local privilege escalation (LPE) to root.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Racy
Target: Linux kernel (versions 3.8 through 4.4.1)
No auth needed
Prerequisites: Local access to the target system · Kernel version within vulnerable range
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (42)

Core 42
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034701
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00038.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2871-1
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-0068.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00026.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2870-2
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00039.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2872-3
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00035.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00043.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2872-1
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00045.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2871-2
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00041.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176194.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00034.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/81054
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2873-1
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00033.html
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-0065.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2870-1
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00044.html
Third Party Advisory x_refsource_confirm
https://bto.bluecoat.com/security-advisory/sa112
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2872-2
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3448
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-0064.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00040.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00012.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/01/19/2
Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/39277/
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1297475
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20160211-0001/

Scores

CVSS v3 7.8
EPSS 0.5618
EPSS Percentile 98.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2016-08-04
Status published
Products (31)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 15.04
canonical/ubuntu_linux 15.10
debian/debian_linux 8.0
google/android 4.0
google/android 4.0.1
google/android 4.0.2
google/android 4.0.3
google/android 4.0.4
... and 21 more
Published Feb 08, 2016
Tracked Since Feb 18, 2026