CVE-2026-16313: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-16313 is a CRLF injection vulnerability in sg3_utils that allows a local attacker with physical access to execute arbitrary commands as root by presenting a crafted SCSI/USB device. The flaw exists in the sg_inq command's --export option, which outputs SCSI device identification data from VPD page 0x83 without sanitizing control characters in name string fields. Affected versions are sg3_utils 1.34 through 1.48; the vulnerability was introduced in commit c410806c (2012-02-23) and publicly disclosed on July 28, 2026. It carries a CVSS v3.1 base score of 7.6 (High) (Red Hat CVE, Github Advisory).

The root cause is CWE-93 (Improper Neutralization of CRLF Sequences), specifically in the export_dev_ids() function within src/sg_inq.c. The SCSI name string designator (VPD page 0x83, designator type 8, line 2046) and the ATA vendor-ID subfield (line 1922) are printed using printf("%.*s") without sanitizing embedded control characters. A crafted SCSI or USB device can embed a newline (\n) in its device-supplied name string, which splits the sg_inq --export KEY=VALUE output into two lines, injecting an arbitrary udev property — including REMOVE_CMD — into the udev database. On systems where default udev rules (e.g., 50-udev-default.rules) invoke sg_inq --export for SCSI device identification and execute REMOVE_CMD on device removal, disconnecting the crafted device triggers arbitrary root command execution. The upstream fix applies udev-conforming character escaping to the affected fields, matching encoding already used for designator types 0 and 1 (Red Hat CVE, Red Hat Bugzilla, GitHub PR #83).

Successful exploitation grants an attacker full root-level command execution on the affected Linux host, resulting in complete compromise of confidentiality, integrity, and availability. Because the injected REMOVE_CMD is executed by udev as root upon device disconnection, the attacker can run any arbitrary command — including installing backdoors, exfiltrating sensitive data, or disrupting system availability — without any prior privileges on the system. The scope is marked as "Changed" in CVSS, reflecting that the impact extends beyond the sg3_utils component itself to the broader operating system (Red Hat CVE, Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The attack requires physical access to a USB or SCSI port (AV:P), making it non-automatable and limiting its reach to insider threats or scenarios involving supply-chain-compromised hardware. The EPSS score is approximately 0.244% (16th percentile), indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Prepare a malicious SCSI/USB device: Using a programmable USB device (e.g., a USB Rubber Ducky, Facedancer, or custom firmware on a USB-to-SCSI adapter), craft a device that responds to SCSI INQUIRY VPD page 0x83 requests with a SCSI name string (designator type 8) containing an embedded newline character followed by an arbitrary udev property, such as REMOVE_CMD=/path/to/malicious_script.
2. Embed the payload: The crafted VPD 0x83 response should look like: ID_WWN=<legitimate_value>\nREMOVE_CMD=<attacker_command>, where \n is a literal newline. When sg_inq --export processes this, it outputs two lines to udev, injecting the REMOVE_CMD property.
3. Connect the device to the target system: Physically plug the crafted device into a USB or SCSI port on a Linux system running an unpatched version of sg3_utils (1.34–1.48) with default udev rules that invoke sg_inq --export on device connection.
4. Trigger udev processing: Upon connection, udev automatically invokes sg_inq --export and imports the output as device properties, including the injected REMOVE_CMD.
5. Execute the payload: Disconnect the crafted device. The default udev rule in 50-udev-default.rules executes the REMOVE_CMD property value as root, running the attacker's arbitrary command (Red Hat CVE, Red Hat Bugzilla).

• Logs: Udev journal entries (journalctl -u systemd-udevd) showing execution of unexpected commands upon SCSI/USB device removal; udevadm monitor output showing unusual REMOVE_CMD properties being set for block or SCSI devices.
• File System: Unexpected scripts or binaries created in world-writable directories (e.g., /tmp, /dev/shm) around the time of device connection/disconnection events; new cron jobs, systemd units, or SSH authorized keys added by root.
• Process: Unusual child processes spawned by udevd or systemd-udevd (e.g., /bin/bash, curl, wget, nc, python) visible in process trees via ps or auditd logs; processes running as root with a parent PID corresponding to udevd.
• Network: Unexpected outbound connections from the host shortly after a USB/SCSI device removal event, particularly to unknown external IPs on non-standard ports.
• udev Database: Presence of a REMOVE_CMD property with a non-standard or suspicious value in the udev database (udevadm info --query=all --name=<device>) for SCSI or USB storage devices (Red Hat CVE, Red Hat Bugzilla).

Red Hat has released patched packages addressing this vulnerability: sg3_utils-1.47-10.el9_8.1 for RHEL 9 (via RHSA-2026:50141) and sg3_utils-1.48-7.el10_2.1 for RHEL 10 (via RHSA-2026:50142). Upstream, the fix is included in sg3_utils version 1.49 via PR #83, which applies udev-conforming character escaping to the affected VPD fields. As an immediate workaround, Red Hat recommends removing or commenting out the REMOVE_CMD rule from 50-udev-default.rules to prevent command execution on device removal; alternatively, disable the udev rule that invokes sg_inq --export if automatic SCSI device identification is not required. Restricting physical access to USB and SCSI ports to trusted personnel is also strongly advised (Red Hat CVE, RHSA-2026:50141, GitHub PR #83).

The vulnerability was originally reported upstream by Shaomin Chen and acknowledged by the sg3_utils maintainer Doug Gilbert, who applied the fix promptly after PR #83 was submitted by Paul Evans in June 2026. The NixOS community responded quickly, merging an update to sg3_utils 1.49 in their package repository to address the CVE. OpenSUSE also backported the fix to their sg3_utils package. The vulnerability received coverage in German Linux security media (pro-linux.de) and was tracked by multiple vulnerability aggregators. No significant social media controversy or broader industry debate has been observed (Red Hat CVE, GitHub PR #83).