CVE-2026-16313: sg3_utils RCE Vulnerability

CVE-2026-16313 Overview

CVE-2026-16313 is a CRLF injection flaw in sg3_utils, a Linux utility suite for interacting with SCSI devices. The sg_inq command, when invoked with the --export option, writes device identification data to output consumed by udev without sanitizing control characters in SCSI name string fields. An attacker who presents a crafted SCSI device can embed a newline character in a device-supplied name string, injecting arbitrary key-value properties into the udev device database. Those injected properties can trigger arbitrary command execution as root when the device is disconnected. The flaw is tracked under CWE-93: Improper Neutralization of CRLF Sequences.

Critical Impact
An attacker with physical access can execute arbitrary commands as root by connecting a malicious SCSI device to a vulnerable Linux host.

Affected Products

sg3_utils (upstream project maintained by Doug Gilbert)
Red Hat Enterprise Linux distributions shipping sg3_utils
Linux systems that invoke sg_inq --export from udev rules

Discovery Timeline

2026-07-28 - CVE-2026-16313 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-16313

Vulnerability Analysis

The sg_inq utility queries SCSI devices for standard inquiry data, including Vital Product Data (VPD) pages that contain device identifiers such as vendor, model, and name strings. When invoked with --export, sg_inq emits KEY=VALUE pairs intended to be consumed as udev environment variables. The vulnerability arises because the tool does not filter control characters, particularly the newline (\n) character, from the SCSI name string field before writing it to output.

When udev parses this output, each line is treated as a separate property assignment. A device that returns a name string containing an embedded newline can therefore terminate the legitimate property and start a new one that udev will accept as authoritative. Because udev rules can invoke helper programs on device add and remove events, injecting a property such as RUN+= or overriding an existing one grants command execution in the udev worker process context, which runs as root.

Root Cause

The root cause is missing input sanitization of untrusted device-supplied strings in the --export code path of sg_inq. SCSI name string fields returned by device VPD page 0x83 are attacker-controlled when the device is malicious or emulated. sg3_utils treats the raw bytes as safe text and forwards them to standard output without stripping or escaping CRLF characters. The upstream fix is tracked in GitHub PR #83 for sg3_utils.

Attack Vector

Exploitation requires physical access or the ability to present a virtual SCSI device to the host, for example through a programmable USB device such as a BadUSB-class implant, a hypervisor-controlled virtio-scsi backend, or an iSCSI target the attacker controls. The attacker programs the device to return a VPD page 0x83 name string containing a newline followed by an injected udev property line. When the kernel enumerates the device, systemd-udevd invokes sg_inq --export, and the crafted output is imported into the udev database. On subsequent device removal, udev evaluates rules against the poisoned database and executes the attacker-supplied command as root.

The vulnerability manifests in the sg_inq --export output path. See the Red Hat CVE-2026-16313 Advisory and Red Hat Bug Report #2502845 for technical details on the vulnerable field handling.

Detection Methods for CVE-2026-16313

Indicators of Compromise

Unexpected properties in the udev database for SCSI devices, visible via udevadm info --query=property --name=/dev/sdX, that include shell metacharacters or RUN+= style directives.
Root-owned processes spawned by systemd-udevd with command lines that do not match legitimate udev rule helpers.
Auditd records showing execve calls originating from systemd-udevd immediately after a SCSI or USB mass-storage disconnect event.
Kernel log entries in dmesg showing SCSI inquiry name strings containing non-printable or control characters.

Detection Strategies

Parse sg_inq --export output during device attach and flag any line whose value contains embedded newlines, carriage returns, or an equals sign followed by a known udev directive.
Correlate udevadm monitor --property events with subsequent process execution under the udev worker cgroup to identify property-injection-to-execution chains.
Baseline the expected set of udev properties for SCSI, USB, and iSCSI devices and alert on properties assigned by sg_inq that fall outside the baseline.

Monitoring Recommendations

Enable auditd rules on /lib/udev/rules.d/ and /etc/udev/rules.d/ and on the sg_inq binary path to detect tampering and unusual invocations.
Ship udev and systemd-udevd journal entries to a centralized log platform for retrospective hunting on newline-bearing property values.
Restrict which endpoints permit new SCSI, USB, or iSCSI device attachment and alert when unauthorized devices enumerate on servers.

How to Mitigate CVE-2026-16313

Immediate Actions Required

Update sg3_utils to the fixed release once your distribution ships the patch from GitHub PR #83 for sg3_utils.
On Red Hat systems, apply the vendor update referenced in the Red Hat CVE-2026-16313 Advisory as soon as errata are published.
Inventory hosts that invoke sg_inq --export from udev rules and prioritize patching servers exposed to untrusted SCSI, USB, or iSCSI sources.

Patch Information

The upstream fix is tracked in GitHub PR #83 for sg3_utils, which sanitizes control characters in SCSI name string fields before emitting them under --export. Distribution package updates are tracked in the Red Hat CVE-2026-16313 Advisory and Red Hat Bug Report #2502845. Apply the vendor-supplied sg3_utils package for your distribution and restart systemd-udevd so the updated binary is used for subsequent device events.

Workarounds

Temporarily remove or disable udev rules that call sg_inq --export on device add events until the patch is applied.
Enforce physical port control and USB device allow-listing on servers and workstations to block untrusted SCSI or USB mass-storage devices.
For virtualized workloads, restrict which tenants can attach virtio-scsi or iSCSI backends and validate device metadata before enumeration.
Configure BIOS/UEFI to disable unused USB and external SCSI controllers on systems that do not require removable storage.

bash

# Verify installed sg3_utils version and confirm patched build
rpm -q sg3_utils
sg_inq --version

# List udev rules that invoke sg_inq to identify exposure
grep -RIn 'sg_inq' /lib/udev/rules.d/ /etc/udev/rules.d/

# Inspect current udev properties for a SCSI device for injected values
udevadm info --query=property --name=/dev/sda | grep -aP '[^\\x20-\\x7e]'