CVE-2026-16313

Name of the Vulnerable Software and Affected Versions sg3 utils (affected versions not specified)

Description A flaw exists in the sg inq command when used with the --export option. The utility fails to sanitize control characters within SCSI name string fields. An attacker providing a specially crafted SCSI device containing a newline character in the name string can inject arbitrary properties into the udev device database. This injection can lead to the execution of arbitrary commands with root privileges when the device is disconnected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.