No single party to fix it: an integer overflow in the Linux kernel
A privilege escalation flaw added to the catalog on 26 January 2026. Its note says the flaw sits in a common component and that patching status must be checked with each vendor.
Key facts
- CVE IDCVE-2018-14634
- Affected (vendor / product)Linux Kernel
- CWECWE-190
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-02-16 (U.S. federal civilian agencies, BOD 22-01)
Key points
- An integer overflow in the Linux kernel function create_elf_tables() enabling privilege escalation by an unprivileged user.
- Added 26 January 2026 with a 16 February deadline, a twenty-one-day window.
- The note directs readers to check patching status with each vendor, and references point at the kernel repository.
- The kernel appears 28 times in the catalog, with ransomware use confirmed on two entries.
1The record does not say who fixes it
The previous article had nothing left to fix. Here a fix exists, but there is no single party who applies it.
The note states that the flaw affects a component used across many products and directs readers to check patching status with each vendor. The references point at the kernel's own repository rather than any product's update notice.
2The path a fix travels
- 1Fixed upstreamThe correction lands in the kernel source
- 2Distributions pick it upEach distribution carries it into its own release
- 3Product vendors pick it upDevices and software built on that distribution ship an update
- 4It reaches the userThe update is applied to the machine in front of you
From where a user stands, it is entirely normal for upstream to be fixed while nothing has yet arrived locally. The catalog window is twenty-one days; how long this path takes depends on each stage.
3Where privilege escalation sits
This is the type in which an unprivileged user climbs by way of a privileged binary. It is not a way in from outside but a way to widen damage once inside. The kernel's 28 entries scatter across weakness types — out-of-bounds write (CWE-787) four, use after free (CWE-416) three — with identifier years from 2010 to 2026.
The next article takes up a record with a window of only three days.
Why it matters
Shared-component flaws cannot be followed by product name. Knowing what your products are built on, and confirming that upstream fixes have arrived, requires a separate process.
FAQ
Why must each vendor be checked separately?
How does an integer overflow lead to privilege escalation?
Is an upstream fix enough?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- Vendor / reference advisory
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).