CVE-2026-16313
Received Received - Intake

sg_inq Command Injection in sg3_utils via SCSI Name String

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Red Hat, Inc.

Description
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-16313
EUVD
EUVD-2026-49906

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-16313 is a command injection flaw in sg3_utils versions 1.34 through 1.48. The vulnerability occurs in the sg_inq --export command when processing SCSI device identification data. It allows an attacker to embed a newline character in a device-controlled name string, which can inject arbitrary udev properties, including REMOVE_CMD. This can lead to arbitrary root-level command execution when the maliciously crafted SCSI device is disconnected.

Detection Guidance

Check sg3_utils version with 'sg_inq --version'. If between 1.34 and 1.48, the system may be vulnerable. Inspect udev rules for unexpected REMOVE_CMD entries using 'cat /etc/udev/rules.d/*' or 'udevadm info -e'.

Impact Analysis

If you use affected sg3_utils versions, an attacker who can present a crafted SCSI device could execute arbitrary commands as root when the device is disconnected. This could lead to system compromise, data theft, or further attacks on your system. The impact is severe due to the potential for full root access.

Compliance Impact

This vulnerability could lead to unauthorized root access, which may result in data breaches or loss of sensitive information. Such incidents could violate compliance requirements under GDPR, HIPAA, or other regulations that mandate strict access controls and data protection measures.

Mitigation Strategies

Update sg3_utils to a patched version. If unavailable, avoid using 'sg_inq --export' with untrusted SCSI devices. Review udev rules for suspicious REMOVE_CMD entries and remove them.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16313. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart