CVE-2018-14634

CVE-2018-14634 is an integer overflow in the Linux kernel's create_elf_tables() function, the code that builds the ELF auxiliary tables when a new program is launched. An unprivileged local user can trigger the overflow by executing a SUID or otherwise privileged binary, corrupting kernel memory and escalating their privileges. A successful attacker gains full root-level control of the affected host, compromising the confidentiality, integrity, and availability of that system. Any system running a Linux kernel in the 2.6.x, 3.10.x, or 4.14.x series is affected, including products from Red Hat, Canonical, Palo Alto Networks (PAN-OS), F5 (BIG-IP), and NetApp that ship those kernels. CISA added this flaw to its Known Exploited Vulnerabilities catalog on 2026-01-26, confirming it is being actively exploited, and EPSS estimates a 14.7% chance of exploitation within 30 days (96th percentile).

What to do: Apply the kernel updates published by Red Hat, Canonical, and other distributors and upgrade affected appliances (PAN-OS and BIG-IP) to the patched releases cited in each vendor's advisory for CVE-2018-14634, per the CISA KEV required action. Inventory hosts and appliances running Linux kernels in the 2.6.x, 3.10.x, or 4.14.x series and verify patched versions are installed. Because this is a local privilege escalation with no network-level mitigation, restrict unprivileged local accounts and limit access to SUID binaries on hosts where patching is delayed.