High severity · published Jul 30, 2019
CVE-2018-16871
A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20
7.5
CVSS
2.7%
EPSS
No
On KEV
Description
A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
3.0 through 4.20 · source: NVD
CB
Cloud Backup · Netapp
All versions, or not specified · source: NVD
DT
Developer Tools · Redhat
1.0 · source: NVD
EL
Enterprise Linux · Redhat
7.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
7.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
7.4 · source: NVD
EL
Enterprise Linux Server · Redhat
7.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
7.4; 7.6 · source: NVD
EL
Enterprise Linux Server Eus · Redhat
7.6 · source: NVD
EL
Enterprise Linux Server Tus · Redhat
7.4; 7.6 · source: NVD
EL
Enterprise Linux Workstation · Redhat
7.0 · source: NVD
HF
H300e Firmware · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-16871
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-16871
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2696
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2730
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0740
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16871
Third Party Advisory
https://security.netapp.com/advisory/ntap-20211004-0002/
Third Party Advisory
https://support.f5.com/csp/article/K18657134
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability