A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characte…

A vulnerability was discovered in sg3_utils where the sg_inq command with the --export option fails to sanitize control characters in SCSI name string fields. An attacker can embed a newline character in a device-supplied name string to inject arbitrary properties into the udev device database. This injection can lead to arbitrary command execution with root privileges when a crafted SCSI device is disconnected from the system. The attack vector requires physical or logical access to present a malicious SCSI device. The flaw is tracked as CVE-2026-16313 and has been reported to Red Hat and the upstream sg3_utils project. A pull request has been submitted on GitHub to address the sanitization issue. The vulnerability is considered high severity due to its potential for full system compromise.