CVE-2026-16313: sg3_utils Vulnerability Allows Root Command Execution via Crafted SCSI Device

A significant vulnerability, identified as CVE-2026-16313, has been discovered in the sg3_utils package, specifically affecting the sg_inq command when used with the --export option. This flaw impacts Red Hat Enterprise Linux 7, 8, 9, and 10. The sg_inq command fails to sanitize control characters, such as newlines, present in SCSI device name string fields. An attacker can exploit this by crafting a malicious SCSI device with a name string containing newline characters and arbitrary udev properties. When this device is connected to a vulnerable system and the sg_inq --export command is executed against it, the unsanitized output can inject malicious configurations into the udev device database. Subsequently, upon disconnection of the crafted SCSI device, these injected udev rules can trigger arbitrary command execution with root privileges, posing a critical risk to system integrity and data confidentiality.

Attack Chain

1. An attacker prepares a physical or virtual SCSI device, embedding malicious udev properties and newline characters within its device identification name string.
2. The attacker connects the specially crafted SCSI device to a vulnerable Linux system, potentially via physical access or by compromising a virtual machine host to attach the device.
3. A user or an automated system with appropriate permissions executes the sg_inq command with the --export option, targeting the crafted SCSI device.
4. The sg_inq utility queries the device and retrieves its identification data, including the unsanitized malicious name string.
5. Due to the vulnerability (lack of sanitization), the newline characters and malicious udev properties from the device name are passed to the system's udev device database or related configuration files.
6. Upon the disconnection of the crafted SCSI device, the udev system processes the newly injected malicious rules.
7. These malicious udev rules are then executed, leading to arbitrary command execution.
8. The commands are executed with root privileges, allowing the attacker to gain full control over the compromised system.

Impact

Successful exploitation of CVE-2026-16313 leads to arbitrary command execution as root on affected Linux systems. This grants the attacker complete control over the compromised system, enabling them to install backdoors, exfiltrate sensitive data, disrupt operations, or establish persistence. The widespread use of sg3_utils in Linux environments means that many systems could be vulnerable if an attacker can present a crafted SCSI device and trigger the sg_inq --export command, which is often used for device inventory or debugging. This vulnerability could be particularly dangerous in environments with untrusted hardware connections or shared virtualized infrastructure.

Recommendation

• Patch CVE-2026-16313 by updating sg3_utils packages to fixed versions immediately on all Red Hat Enterprise Linux 7, 8, 9, and 10 systems.
• Restrict physical access to systems to prevent attackers from connecting crafted SCSI devices.
• Implement strong access controls and monitoring around the sg_inq command, especially when used with the --export option, to detect unusual or unauthorized execution.
• Enable comprehensive logging for udev activities to identify anomalous rule injections or command executions originating from udev events.