CVE-2026-16313

Summary

A flaw was found in sg3_utils. The sg_inq command, when invoked with the –export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

Affected Software

Weaknesses

• CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

Workarounds

Remove or comment out the REMOVE_CMD rule from 50-udev-default.rules to prevent command execution on device removal. Alternatively, if automatic SCSI device identification is not required, disable the udev rule that invokes sg_inq –export on device connection.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://access.redhat.com/security/cve/CVE-2026-16313
• https://bugzilla.redhat.com/show_bug.cgi?id=2502845
• https://github.com/doug-gilbert/sg3_utils/pull/83

• ←Previous
• Next→