CVE-2026-16313 Red Hat CVE debrief

Who should care

System administrators and security teams responsible for sg3_utils installations, especially in environments with untrusted SCSI device connections, should be aware of this vulnerability and take immediate action to mitigate the risk. They should review system logs for suspicious activity related to the sg_inq command and assess their installations for exposure. Additionally, they should implement compensating controls to restrict SCSI device connections and apply vendor patches or updates when available.

Technical summary

The sg_inq command in sg3_utils does not sanitize control characters in SCSI name string fields when used with the --export option. This allows a newline character in a device-supplied name string to inject arbitrary properties into the udev device database. An attacker presenting a crafted SCSI device could execute arbitrary commands as root when the device is disconnected. The vulnerability has a high CVSS score of 7.6, indicating a high severity level.

Defensive priority

High-priority defensive actions are required due to the high CVSS score of 7.6 and the potential for arbitrary command execution as root.

Recommended defensive actions

• Inventory and assess sg3_utils installations for exposure
• Apply vendor patches or updates when available
• Implement compensating controls to restrict SCSI device connections
• Monitor system logs for suspicious activity related to sg_inq command
• Review system configurations for potential vulnerabilities
• Conduct regular security audits to identify potential weaknesses
• Verify that all necessary patches have been applied

Evidence notes

Evidence is based on limited information from the NVD and a few Red Hat references. Further verification is needed to confirm the full scope of affected systems and potential workarounds. Additional review of vendor documentation and security advisories is recommended to ensure accurate assessment of vulnerability impact. The sg_inq command outputs device identification data without sanitizing control characters in SCSI name string fields, which could allow an attacker to inject arbitrary properties into the udev device database.

Official resources