CVE-2026-16313

What it actually does

The sg_inq --export command in sg3_utils fails to sanitize control characters (specifically newlines) present in SCSI device identification strings, allowing those characters to be written directly into the udev device database as property assignments.

Why it matters to the business

An attacker with physical access to attach a malicious SCSI device can trigger arbitrary command execution as root upon device removal, potentially leading to full system compromise without requiring network access or credentials.

How an attack unfolds

An attacker crafts a SCSI device whose inquiry response embeds newline characters inside a device identifier field. When sg_inq --export is later invoked on that device, the unsanitized output is processed by udev, injecting arbitrary property rules. Upon device disconnection, udev executes the injected rules, running attacker-controlled commands with root privileges.

How to fix it

Update sg3_utils to a version that sanitizes control characters in SCSI name fields before writing to udev output. Until a fixed release is available, avoid using the --export option on untrusted devices and restrict physical access to SCSI interfaces.

How to confirm the fix worked

Confirm sg3_utils version is newer than the vulnerable release; test by attaching a device that returns a name containing a newline and verifying that the resulting udev properties do not contain injected assignments.

Typical attack path

1. Attacker physically connects a crafted SCSI device whose inquiry data contains embedded newlines in name strings
2. System or administrator runs sg_inq --export against the device, producing udev-compatible output that includes the injected properties
3. Udev database incorporates the malicious properties without validation
4. Attacker disconnects the device, triggering udev rule processing that executes the injected commands as root

How to detect it

Review udev logs and rule application events around the time of SCSI device attach/detach for unexpected property assignments containing newlines or shell metacharacters; correlate with sg_inq process execution in audit logs.

• sg_inq.*--export
• udev.*property.*newline
• scsi inquiry response containing \n

What your security team should do

• Restrict physical access to systems with SCSI interfaces until a patched sg3_utils package is deployed
• Monitor for availability of fixed sg3_utils packages and schedule immediate updates once released
• Audit scripts and services that invoke sg_inq --export and replace or guard them against untrusted devices