CVE-2026-16313

CVE-2026-16313 is a newline injection vulnerability in sg_inq (part of sg3_utils) that allows device-supplied strings to inject arbitrary properties into udev's database, enabling root-level command execution under specific conditions. The attack works like this: sg_inq's --export flag outputs SCSI device inquiry data as key-value pairs suitable for udev property assignment. When device name, vendor, or model fields contain embedded newline characters, subsequent lines are parsed as new udev properties. A maliciously crafted SCSI device (or one presenting crafted inquiry data) can inject properties that udev rules then act on — potentially executing commands configured to run on property matches. The critical condition is that something must invoke sg_inq --export and pipe its output to udev. If udev itself calls this during device enumeration, you have a direct attack chain. The vulnerability also affects any admin script or configuration management tool that pipes sg_inq --export output into shell evaluation or udev property files. Check your udev rules for invocations of sg_inq with the --export flag or any structured output mode. Search rule files for patterns like 'sg_inq.*export' or 'ENV{.*}`sg_inq'. If you find such rules, the device enumeration path can trigger the injection. More broadly, audit any pipeline that takes sg_inq output and feeds it to a privileged consumer without sanitizing newlines. The fix should be in sg3_utils itself — the --export output needs to escape or strip newline and other shell-metacharacters from device-supplied fields. Upgrading sg3_utils to the latest version should resolve it. After patching, verify that --export output no longer contains unescaped newlines in any field by running: sg_inq --export /dev/sgX | grep -q '^[^=]*=' && echo 'OK' || echo 'FAIL' — and manually inspect a few device outputs to confirm. Note that this is the same vulnerability class that's appeared in syslog, SNMP, and /proc interfaces over the years — device-supplied strings flowing into privileged consumers without sanitization. The pattern is well-known; the specific instantiation is sg_inq to udev.

Reviewed through automated stages and approved by a human before publication.