CVE-2026-16313

Name	CVE-2026-16313
Description	A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
sg3-utils (PTS)	bullseye	1.45-1	vulnerable
	bookworm	1.46-3	vulnerable
	trixie	1.48-2	vulnerable
	forky, sid	1.48-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
sg3-utils	source	(unstable)	(unfixed)

https://bugzilla.redhat.com/show_bug.cgi?id=2502845
https://github.com/doug-gilbert/sg3_utils/pull/83