PT-2026-65529 · Red Hat · Red Hat Enterprise Linux 10+5

CVE-2026-16313 · Published 2026-07-28 · Updated 2026-07-28

Mitre

CVSS v3.1

7.6

High

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

A flaw was found in sg3 utils. The sg inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-16313

Affected Products

Red Hat Enterprise Linux 10

Red Hat Enterprise Linux 6

Red Hat Enterprise Linux 7

Red Hat Enterprise Linux 8

Red Hat Enterprise Linux 9

Red Hat Openshift Container Platform 4

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-16313 · Security Note
• https://github.com/doug-gilbert/sg3_utils/pull/83 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2502845 · Note
• https://access.redhat.com/security/cve/CVE-2026-16313 · Note