CVE-2026-16313

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-07-28

Last updated on: 2026-10-14

Assigner: redhat-SADP

Description

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-10-14

Generated

2026-10-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-10-16

NVD

CVE-2026-16313

EUVD

EUVD-2026-49906

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	sg3_utils	From 1.34 (inc) to 1.48 (inc)
red_hat	sg3_utils	*
red_hat	open_shift_container_platform	4.22.10
red_hat	open_shift_container_platform	4.21.32
red_hat	open_shift_container_platform	4.18
red_hat	open_shift_container_platform	4.16.71
red_hat	open_shift_container_platform	4.20.37
red_hat	enterprise_linux	8.4
red_hat	enterprise_linux	8.6
red_hat	enterprise_linux	9
red_hat	enterprise_linux	9.2
red_hat	enterprise_linux	9.4
red_hat	enterprise_linux	10
red_hat	enterprise_linux	10.0
red_hat	enterprise_linux	8.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-93	The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

Executive Summary

CVE-2026-16313 is a command injection flaw in sg3_utils versions 1.34 through 1.48. The vulnerability occurs in the sg_inq --export command when processing SCSI device identification data. It allows an attacker to embed a newline character in a device-controlled name string, which can inject arbitrary udev properties, including REMOVE_CMD. This can lead to arbitrary root-level command execution when the maliciously crafted SCSI device is disconnected.

Detection Guidance

Check sg3_utils version with 'sg_inq --version'. If between 1.34 and 1.48, the system may be vulnerable. Inspect udev rules for unexpected REMOVE_CMD entries using 'cat /etc/udev/rules.d/*' or 'udevadm info -e'.

Impact Analysis

If you use affected sg3_utils versions, an attacker who can present a crafted SCSI device could execute arbitrary commands as root when the device is disconnected. This could lead to system compromise, data theft, or further attacks on your system. The impact is severe due to the potential for full root access.

Compliance Impact

This vulnerability could lead to unauthorized root access, which may result in data breaches or loss of sensitive information. Such incidents could violate compliance requirements under GDPR, HIPAA, or other regulations that mandate strict access controls and data protection measures.

Mitigation Strategies

Update sg3_utils to a patched version. If unavailable, avoid using 'sg_inq --export' with untrusted SCSI devices. Review udev rules for suspicious REMOVE_CMD entries and remove them.

Hi! I’m here to help you understand CVE-2026-16313. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70