Description
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
References10
- access.redhat.com/errata/RHSA-2026:50141
- access.redhat.com/errata/RHSA-2026:50142
- access.redhat.com/errata/RHSA-2026:54769
- access.redhat.com/errata/RHSA-2026:56130
- access.redhat.com/errata/RHSA-2026:59397
- access.redhat.com/errata/RHSA-2026:59555
- access.redhat.com/errata/RHSA-2026:59567
- access.redhat.com/errata/RHSA-2026:59568
- access.redhat.com/errata/RHSA-2026:61260
- access.redhat.com/errata/RHSA-2026:61261
Metrics
- CVSS 3.1
-
7.6
HIGH
Score source: CNA
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 29 · as of 13 November 2026
- CWE
- CWE-93
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.