CVE-2018-14634: Linux kernel create_elf_tables() integer overflow privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityLocal privilege escalation to root with public exploit code and KEV listing, but it requires an existing unprivileged account and a SUID binary, so it is not remotely exploitable.

What it is

An integer overflow in the Linux kernel's create_elf_tables() function lets an unprivileged local user escalate privileges when a SUID or otherwise privileged binary is present. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable, and the flaw affects the kernel as shipped in multiple vendor products. Because it yields full root-level compromise from a low-privilege local account, it is a serious post-access escalation path.

Impact

An attacker with a local unprivileged account gains full control of the host, including confidentiality, integrity and availability of all data and processes. This turns any low-privilege foothold into complete system compromise.

Attack surface

Reached locally: the CVSS vector is AV:L/PR:L/UI:N, so the attacker needs an existing unprivileged account and no user interaction. A SUID or otherwise privileged binary must be present on the system for the escalation to succeed.

Exploitation

CISA added this to KEV on 2026-01-26 with a remediation due date of 2026-02-16, and EPSS gives a 30-day probability of 0.14689 (96th percentile). Public exploit code is referenced (Exploit-DB 45516 and an oss-security post tagged Exploit), though no ransomware campaign use is documented.

What to do

• Patch the Linux kernel to a vendor-fixed release; apply the Red Hat, Ubuntu, F5, NetApp and Palo Alto advisories listed in the references.
• If patching is not immediately possible, follow vendor mitigation instructions and BOD 22-01 guidance for cloud services, or discontinue use of the affected product.
• Reduce the number of SUID/privileged binaries on hosts and remove those not strictly required, since the flaw needs one to be present.
• Restrict and monitor local interactive access so unprivileged accounts are limited to trusted users.
• Track KEV remediation deadlines (due 2026-02-16) and confirm affected appliances and kernels are covered.

Detection

• Audit hosts for unpatched kernel versions in the 2.6.x, 3.10.x and 4.14.x lines and for vendor products listed as affected.
• Monitor for unexpected privilege transitions to root by non-root accounts, especially processes spawned from SUID binaries.
• Alert on execution of known public exploit code or suspicious ELF argument manipulation against privileged binaries.
• Review local account creation and login activity for signs of an unprivileged foothold being used to attempt escalation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.