CVE-2026-16313

CVE Details

Release Date:	2026-07-28
Impact:	Important	What is this?

Description

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

See more information about CVE-2026-16313 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.6
Vector String:	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Version:	3.1
Attack Vector:	Physical
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	None
Scope:	Changed
Confidentiality Impact:	High
Integrity Impact:	High
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 10 (sg3_utils)	ELSA-2026-50142-0	2026-08-04
Oracle Linux version 9 (sg3_utils)	ELSA-2026-50141-0	2026-08-04