High severity7.6NVD Advisory· Published Jul 28, 2026· Updated Sep 9, 2026
CVE-2026-16313
CVE-2026-16313
Description
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- osv-coords3 versions
< 1.47-10.el9_8.1+ 2 more
- (no CPE)range: < 1.47-10.el9_8.1
- (no CPE)range: < 1.47-10.el9_8.1
- (no CPE)range: < 1.47-10.el9_8.1
Patches
Vulnerability mechanics
References
16- access.redhat.com/errata/RHSA-2026:50141nvd
- access.redhat.com/errata/RHSA-2026:50142nvd
- access.redhat.com/errata/RHSA-2026:54769nvd
- access.redhat.com/errata/RHSA-2026:56130nvd
- access.redhat.com/errata/RHSA-2026:59397nvd
- access.redhat.com/errata/RHSA-2026:59555nvd
- access.redhat.com/errata/RHSA-2026:59567nvd
- access.redhat.com/errata/RHSA-2026:59568nvd
- access.redhat.com/errata/RHSA-2026:61260nvd
- access.redhat.com/errata/RHSA-2026:61261nvd
- access.redhat.com/errata/RHSA-2026:63041nvd
- access.redhat.com/errata/RHSA-2026:63044nvd
- access.redhat.com/errata/RHSA-2026:63100nvd
- access.redhat.com/security/cve/CVE-2026-16313nvd
- bugzilla.redhat.com/show_bug.cginvd
- github.com/doug-gilbert/sg3_utils/pull/83nvd
News mentions
0No linked articles in our index yet.