CVE-2026-16313

ADVISORY - debian

Summary

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

sg3-utils (bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1143004) https://bugzilla.redhat.com/show_bug.cgi?id=2502845 https://github.com/doug-gilbert/sg3_utils/pull/83

Common Weakness Enumeration (CWE)

Impacted images

Advisories

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.