CVE-2018-14634
Published: January 26, 2026
Official Description
Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.
CISA KEV Advisory
Linux Kernel Integer Overflow Vulnerability
Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Risk Analysis
This high-severity integer overflow in the Linux Kernel's create_elf_tables() function allows a local unprivileged user to escalate privileges. With a CVSS score of 7.8 and confirmed exploitation in the wild, this is a critical local privilege escalation vulnerability. The EPSS score of 0.25699 further emphasizes the high likelihood of exploitation.
This vulnerability is actively being exploited in the wild and is included in CISA's KEV catalog. Exploitation requires local access to a system with a SUID or otherwise privileged binary.
Apply the latest security patches for the Linux Kernel. Regularly audit and restrict the use of SUID binaries to minimize the attack surface for local privilege escalation.
Technical Analysis
CVE-2018-14634 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.
CISA has added CVE-2018-14634 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
All References (4)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2018-14634 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1