CVE-2018-14634: Linux kernel create_elf_tables() integer overflow (Mutagen Astronomy)

Exploited in the wild High 7.8 EPSS 14.7% Linux kernel

An integer overflow in the kernel's create_elf_tables() lets a local user who runs a SUID-root program with an enormous argument and environment list redirect its stack and gain root. Only 64-bit systems are exploitable, and the published exploit needs about 32 GB of RAM. Kernels that include commit da029c11e6b1 (Linux 4.13 and most distribution LTS kernels by 2018) are not exploitable; RHEL 6 and 7 and Debian 8 were. CISA added it to KEV on 26 January 2026.

Also known as “Mutagen Astronomy”.

• CVE-2018-14634CVE identifier
• 7.8CVSS 3.0 base score (high)
• 2026-01-26added to CISA's exploited list (US federal deadline 2026-02-16)
• 14.7%EPSS: chance of exploitation in the next 30 days (higher than 97% of CVEs)
• 2018-09-25published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• Kernels with commit b6a2fea39318 (July 2007) but without commit da029c11e6b1 (Qualys)
• Red Hat Enterprise Linux 6 and 7 kernels before the September/October 2018 updates

Fixed in:

• Linux 4.13 (commit da029c11e6b1, 'exec: Limit arg stack to at most 75% of _STK_LIM')

Am I affected?

uname -r
dpkg -l 'linux-image*' | grep ^ii   # Debian/Ubuntu
rpm -q kernel   # RHEL/Fedora/Amazon/SUSE (SUSE: rpm -q kernel-default)

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

# Debian 9 and later ship fixed kernels; Debian 8 needed DLA-1529-1.
sudo apt update
sudo apt upgrade
sudo reboot

# Ubuntu 18.04 and later are not affected (Ubuntu).
sudo apt update
sudo apt upgrade
sudo reboot

# RHEL 8 and later are not affected; RHEL 6/7 need the 2018 kernel updates or later.
sudo yum update kernel
sudo reboot

sudo dnf upgrade --refresh kernel
sudo reboot

sudo zypper refresh
sudo zypper patch --category security
sudo reboot

# Amazon Linux 2023
sudo dnf upgrade --releasever=latest 'kernel*'
# Amazon Linux 2
sudo yum update kernel
sudo reboot

sudo pacman -Syu
sudo reboot

# as root
apk update
apk upgrade
reboot

not Linux

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

• Red Hat published a SystemTap-based workaround on its CVE page that caps the stack rlimit during exec; it needs kernel-debuginfo and systemtap and must be reloaded after each boot. Updating the kernel is simpler.

Sources

• CVE record CVE-2018-14634
• NVD CVE-2018-14634
• CISA KEV entry CVE-2018-14634
• Debian security tracker CVE-2018-14634
• Ubuntu CVE page CVE-2018-14634
• Red Hat CVE page CVE-2018-14634
• SUSE CVE page CVE-2018-14634
• Amazon Linux ALAS CVE page CVE-2018-14634
• Qualys advisory: Mutagen Astronomy (oss-security)
• Red Hat vulnerability article: Mutagen Astronomy
• Upstream commit da029c11e6b1 (exec: Limit arg stack to at most 75% of _STK_LIM)
• Red Hat RHSA-2018:3540
• https://security.netapp.com/advisory/ntap-20190204-0002/
• https://access.redhat.com/errata/RHSA-2018:2925
• https://access.redhat.com/errata/RHSA-2018:3591
• https://www.exploit-db.com/exploits/45516/
• https://usn.ubuntu.com/3775-1/
• https://access.redhat.com/errata/RHSA-2018:2933
• https://usn.ubuntu.com/3779-1/
• https://access.redhat.com/errata/RHSA-2018:2748

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.