PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-10208 Linux CVE debrief

CVE-2016-10208 is a Linux kernel ext4 vulnerability in ext4_fill_super that can lead to a denial of service through an out-of-bounds read and crash when a crafted ext4 image is processed. NVD maps the issue to Linux kernel versions through 4.9.8 and assigns CVSS 4.3 (MEDIUM) with a physical-access attack vector. The main risk is kernel instability on systems that may mount untrusted or attacker-supplied ext4 media or images.

Vendor
Linux
Product
CVE-2016-10208
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-06
Original CVE updated
2026-05-13
Advisory published
2017-02-06
Advisory updated
2026-05-13

Who should care

Linux distributors, kernel maintainers, endpoint and server administrators, and anyone operating systems that may mount removable media, disk images, or other untrusted ext4 filesystems. Environments that allow local or physically proximate access to storage media should pay particular attention.

Technical summary

According to the NVD description, ext4_fill_super in fs/ext4/super.c did not properly validate meta block groups. That weakness could allow a crafted ext4 image to trigger an out-of-bounds read, which in turn may cause a kernel crash. NVD lists CWE-125 and marks Linux kernel versions through 4.9.8 as affected.

Defensive priority

Medium priority. The issue is a denial-of-service condition rather than a direct code-execution flaw, but it affects kernel code and can crash affected systems. Priority should increase on systems that routinely ingest untrusted external media or disk images.

Recommended defensive actions

  • Apply the relevant Linux kernel or distribution security updates that address CVE-2016-10208.
  • Confirm whether any deployed kernel version is at or below 4.9.8 and update if it is within the affected range listed by NVD.
  • Treat ext4 images and removable storage from untrusted or physically accessible sources as high risk and avoid mounting them on sensitive systems.
  • Review vendor advisories and errata associated with the kernel package in your distribution, including the linked Red Hat, Debian LTS, and Ubuntu references.
  • If immediate patching is not possible, limit physical and local access to systems that mount external media and reduce exposure to untrusted filesystem images.

Evidence notes

This debrief is based on the supplied NVD record and its referenced official/vendor links. The CVE was published on 2017-02-06 and most recently modified on 2026-05-13, but those dates describe record timing, not the original bug creation date. NVD states the flaw is in ext4_fill_super, involves improper validation of meta block groups, can cause an out-of-bounds read and crash, and affects Linux kernel versions through 4.9.8. The record also lists CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H and CWE-125.

Official resources

CVE published 2017-02-06; NVD record last modified 2026-05-13. The supplied references indicate later vendor and mailing-list remediation activity, but the CVE publication date remains the primary public disclosure anchor.