Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

Summary

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

Timeline

1. Jul 28, 2026, 4:47 PM UTCCVE published
2. Jul 28, 2026, 7:34 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 8, 2026, 8:44 PM UTCRecord last updated

Affected versions

• sg3_utils

  Version range not reported

• sg3_utils

  Version range not reported

• sg3_utils

  Version range not reported

• sg3_utils

  Version range not reported

• sg3_utils

  Version range not reported

• sg3_utils

  Version range not reported

• sg3_utils

  Version range not reported

• sg3_utils

  Version range not reported

• sg3_utils

  Version range not reported

• sg3_utils

  Version range not reported

• sg3_utils

  Version range not reported

• sg3_utils

  Version range not reported

• sg3_utils

  Version range not reported

• sg3_utils

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• sg3_utils

  Version range not reported

References 22