A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
References
Configurations
No configuration.
History
14 Oct 2026, 22:10
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
01 Oct 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 Sep 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Sep 2026, 04:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
17 Sep 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
17 Sep 2026, 08:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2026-07-28 17:16
Updated : 2026-10-31 15:16
NVD link : CVE-2026-16313
Mitre link : CVE-2026-16313
CVE.ORG link : CVE-2026-16313
JSON object : View
Products Affected
No product.
CWE
CWE-93
Improper Neutralization of CRLF Sequences ('CRLF Injection')