PT-2026-65529 · Red Hat · Red Hat Enterprise Linux 10+5

CVE-2026-16313 · Publicado 2026-07-28 · Atualizado 2026-07-28

Mitre

CVSS v3.1

7.6

Alta

Vetor base

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

A flaw was found in sg3 utils. The sg inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

Correção

Enumeração de Fraquezas

CWE-93

Identificadores relacionados

CVE-2026-16313

Produtos afetados

Red Hat Enterprise Linux 10

Red Hat Enterprise Linux 6

Red Hat Enterprise Linux 7

Red Hat Enterprise Linux 8

Red Hat Enterprise Linux 9

Red Hat Openshift Container Platform 4

Referências · 4

• https://github.com/doug-gilbert/sg3_utils/pull/83 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2502845 · Nota
• https://access.redhat.com/security/cve/CVE-2026-16313 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-16313 · Nota de Segurança