CVE-2015-3290 in Linux
Summary
by MITRE
arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/19/2025
The vulnerability identified as CVE-2015-3290 represents a critical privilege escalation flaw within the Linux kernel's x86_64 architecture implementation. This issue specifically affects kernel versions prior to 4.1.6 and stems from improper handling of nested Non-Maskable Interrupts within the entry_64.S file. The flaw exploits a dependency on the espfix64 mechanism during NMI processing, creating a window of opportunity for local attackers to execute arbitrary code with elevated privileges. The vulnerability manifests when an NMI occurs during a specific instruction window, allowing malicious code to manipulate the kernel's execution context and potentially elevate privileges from a regular user to root level.
The technical root cause of this vulnerability lies in the kernel's handling of stack pointer management during nested interrupt processing. The espfix64 mechanism, designed to maintain proper stack alignment for 32-bit compatibility mode, fails to properly account for the nested NMI scenario where the kernel must switch between different execution contexts. During NMI processing, the kernel's entry point code relies on espfix64 to adjust the stack pointer, but this adjustment occurs at an inappropriate time during nested interrupt handling. This timing issue creates a race condition where the stack pointer becomes misaligned, allowing an attacker to manipulate the kernel's memory layout and execute code with kernel privileges.
The operational impact of CVE-2015-3290 is severe and affects all Linux systems running kernel versions before 4.1.6 on x86_64 platforms. Local attackers who can execute code on the target system can exploit this vulnerability to gain root privileges without requiring additional attack vectors or complex exploitation techniques. The vulnerability does not require network access or specific user interaction, making it particularly dangerous as it can be exploited by any local user with minimal privileges. The attack vector is specifically tied to triggering an NMI within a precise instruction window, which can be accomplished through carefully crafted kernel modules or system calls that generate such interrupts. This makes the vulnerability particularly concerning for systems where local users have access to potentially malicious code execution capabilities.
This vulnerability maps directly to CWE-121 and CWE-122 within the Common Weakness Enumeration framework, representing stack-based buffer overflow conditions and heap-based buffer overflow conditions respectively. The flaw also aligns with ATT&CK technique T1068, which describes the use of local privilege escalation techniques through kernel exploits. The attack requires a local user context but leverages kernel-level mechanisms to achieve privilege escalation, making it a classic example of a kernel exploit that bypasses traditional user-space security controls. The vulnerability demonstrates how seemingly minor stack management issues in kernel code can result in catastrophic privilege escalation outcomes.
Mitigation strategies for CVE-2015-3290 primarily involve upgrading to Linux kernel version 4.1.6 or later, where the vulnerability has been patched through proper handling of the espfix64 mechanism during nested NMI processing. System administrators should also implement additional security measures including disabling unnecessary kernel modules, restricting local user privileges where possible, and monitoring for unusual NMI activity. The patch addresses the core issue by ensuring proper stack pointer management during nested interrupt scenarios and eliminates the instruction window where the vulnerability could be exploited. Organizations should also consider implementing kernel hardening measures such as kernel address space layout randomization and stack canaries to further reduce the attack surface and make exploitation more difficult even if the specific vulnerability is not patched.