CVE-2016-9576: The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly res...

Security readout for executives and security teams

CVE-2016-9576 is a Linux kernel flaw that can let a local user with access to a SCSI generic device read or write kernel memory or crash the system. It is not remotely reachable from the internet based on the provided sources, but it matters on shared systems and hosts with untrusted local users. Exposure is most likely on Linux systems running kernels before 4.8.14, or vendor kernels without the relevant backport, where local users can access /dev/sg. Distribution impact must be checked against vendor advisories because the bundle does not provide complete affected package versions. Treat as high priority for shared Linux infrastructure. This is a local bug, so internet exposure alone is not the main driver. The business concern is local privilege-adjacent kernel memory access and denial of service on systems where users or workloads are not fully trusted. Mitigation focus: Apply the upstream Linux 4.8.14 fix or your distribution's backported kernel update.; Review Red Hat and SUSE advisories for affected package status in your environment.; Restrict untrusted local access to /dev/sg where operationally feasible..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.