CVE-2026-16313

Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

State: Published
Severity: 7.6 High
Published: Jul 28, 2026
Updated: Nov 2, 2026
Reserved: Jul 20, 2026

Description

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

Scores

CVSS	Score	Vector	Source
3.1	7.6 High	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	redhat

Weaknesses

CWE-93 Improper Neutralization of CRLF Sequences

Affected Products

Product	Versions
Red Hat Enterprise Linux 10Red Hat	0:1.48-7.el10_2.1 and laterNot affected
Red Hat Enterprise Linux 10.0 Extended Update SupportRed Hat	0:1.48-7.el10_0.2 and laterNot affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat	1:1.37-20.el7_9 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	0:1.44-6.el8_10.1 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat	0:1.44-5.el8_4.1 and laterNot affected
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRed Hat	0:1.44-5.el8_4.1 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat	0:1.44-5.el8_6.1 and laterNot affected
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-OnRed Hat	0:1.44-5.el8_6.1 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat	0:1.44-6.el8_8.1 and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat	0:1.44-6.el8_8.1 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:1.47-10.el9_8.1 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat	0:1.47-9.el9_2.1 and laterNot affected
Red Hat Enterprise Linux 9.4 Update Services for SAP SolutionsRed Hat	0:1.47-9.el9_4.1 and laterNot affected
Red Hat Enterprise Linux 9.6 Extended Update SupportRed Hat	0:1.47-10.el9_6.2 and laterNot affected
Red Hat OpenShift Container Platform 4.12Red Hat	412.86.202609082051-0 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat	416.94.202609140240-0 and laterNot affected
Red Hat OpenShift Container Platform 4.17Red Hat	417.94.202609191027-0 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat	418.94.202609031320-0 and laterNot affected
Red Hat OpenShift Container Platform 4.19Red Hat	4.19.9.6.202609021231-0 and laterNot affected
Red Hat OpenShift Container Platform 4.20Red Hat	4.20.9.6.202609021029-0 and laterNot affected
Red Hat OpenShift Container Platform 4.21Red Hat	4.21.9.6.202609021100-0 and laterNot affected
Red Hat OpenShift Container Platform 4.22Red Hat	4.22.9.8.202608130832-0 and laterNot affected
Red Hat Enterprise Linux 6Red Hat
Red Hat OpenShift Container Platform 5Red Hat

References

RHSA-2026:50141vendor-advisory
RHSA-2026:50142vendor-advisory
RHSA-2026:54769vendor-advisory
RHSA-2026:56130vendor-advisory
RHSA-2026:59397vendor-advisory
RHSA-2026:59555vendor-advisory
RHSA-2026:59567vendor-advisory
RHSA-2026:59568vendor-advisory
RHSA-2026:61260vendor-advisory
RHSA-2026:61261vendor-advisory
RHSA-2026:63041vendor-advisory
RHSA-2026:63044vendor-advisory
RHSA-2026:63100vendor-advisory
RHSA-2026:65851vendor-advisory
RHSA-2026:65907vendor-advisory
RHSA-2026:67157vendor-advisory
RHSA-2026:67935vendor-advisory
RHSA-2026:69124vendor-advisory
RHSA-2026:70586vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-16313vdb-entry
RHBZ#2502845issue-tracking
https://github.com/doug-gilbert/sg3_utils/pull/83

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.