CVE-2016-10088: The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situat...

Security readout for executives and security teams

CVE-2016-10088 is a Linux kernel flaw in the SCSI generic device interface. A local user with access to a /dev/sg device could read or write kernel memory or crash the system. The issue affects Linux kernels through 4.9 and stems from an incomplete fix for CVE-2016-9576. Exposure is most likely on Linux systems running kernels through 4.9 where local users, tenants, containers, or services can access /dev/sg devices. Red Hat advisories indicate downstream packages were updated, but the bundle does not list all affected distributions. Prioritize remediation on shared Linux infrastructure because local device access could become kernel-level memory access or system crash. This is less urgent for fully patched systems or systems without untrusted local /dev/sg access, but the kernel impact warrants prompt verification. Mitigation focus: Apply the relevant kernel update from the operating system vendor.; Check Red Hat RHSA advisories if running affected Red Hat packages.; Confirm the kernel includes upstream commit 128394eff343fc6d2f32172f03e24829539c5835..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.