{"id":"CVE-2026-16313","title":"A flaw was found in sg3_utils","summary":"A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-suppl…","severity":"high","cvss":7.6,"cvssVector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-93"],"vendor":"Red Hat","product":"sg3_utils","affected":["sg3_utils (all versions)","sg3_utils (all versions)","sg3_utils (all versions)","sg3_utils (all versions)","sg3_utils (all versions)","sg3_utils (all versions)","sg3_utils (all versions)","sg3_utils (all versions)","sg3_utils (all versions)","sg3_utils (all versions)","sg3_utils (all versions)","sg3_utils (all versions)","sg3_utils (all versions)","sg3_utils (all versions)","rhcos (all versions)","rhcos (all versions)","rhcos (all versions)","rhcos (all versions)","rhcos (all versions)","rhcos (all versions)","sg3_utils","openshift/ose-rhel-coreos-9 (all versions)"],"patched":["openshift_container_platform 4.20","openshift_container_platform 4.21","openshift_container_platform 4.22","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_baseos_aus_v_8_4","enterprise_linux_baseos_eus_extension_v_8_4","enterprise_linux_baseos_aus_v_8_6","enterprise_linux_baseos_eus_extension_v_8_6","enterprise_linux_baseos_e4s_v_8_8","enterprise_linux_baseos_tus_v_8_8","enterprise_linux_baseos_e4s_v_9_2","enterprise_linux_baseos_e4s_v_9_4","enterprise_linux_baseos_eus_v_9_6","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_crb_v_8","codeready_linux_builder_eus_v_9_6","enterprise_linux_codeready_linux_builder_v_9"],"published":"2026-07-28","updated":"2026-09-24","sourceUpdated":"2026-09-24T12:17:11.790","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16313","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:50141","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:50142","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:54769","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:56130","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:59397","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:59555","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:59567","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:59568","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:61260","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:61261","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:63041","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:63044","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:63100","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:65851","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:65907","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67157","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67935","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69124","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-16313","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502845","label":"secalert@redhat.com"},{"url":"https://github.com/doug-gilbert/sg3_utils/pull/83","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16313.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16313"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16313"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00348,"epssPercentile":0.25642,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-07-28T19:34:37.859276Z"},"ingestedAt":"2026-08-24T13:03:32.398Z","slug":"CVE-2026-16313","body":"## Overview\n\nA flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:63100** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:63100)\n- **RHSA-2026:63041** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:63041)\n- **RHSA-2026:54769** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:54769)\n- **RHSA-2026:50142** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50142)\n- **RHSA-2026:56130** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56130)\n- **RHSA-2026:59555** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59555)\n- **RHSA-2026:59567** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59567)\n- **RHSA-2026:59568** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8) · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59568)\n- **RHSA-2026:61261** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61261)\n- **RHSA-2026:61260** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS E4S (v.9.4) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61260)\n- **RHSA-2026:59397** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6) · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59397)\n- **Red Hat VEX** · Important · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16313.json)\n- **RHSA-2026:63044** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:63044)\n- **RHSA-2026:67157** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67157)\n- **RHSA-2026:65907** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:65907)\n- **RHSA-2026:65851** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:65851)\n- **RHSA-2026:69124** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69124)\n- **RHSA-2026:67935** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:67935)","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}