CVE-2026-16313: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-16313 is a CRLF injection vulnerability in sg3_utils that allows an attacker with physical access to execute arbitrary commands as root by presenting a crafted SCSI/USB device. The flaw exists in the sg_inq command's --export option, which outputs SCSI device identification data from VPD page 0x83 without sanitizing control characters in name string fields. Affected versions are sg3_utils 1.34 through 1.48; version 1.49 and Red Hat-patched packages (sg3_utils-1.47-10.el9_8.1 for RHEL 9, sg3_utils-1.48-7.el10_2.1 for RHEL 10) are unaffected. The vulnerability was disclosed on July 28, 2026, and carries a CVSS v3.1 base score of 7.6 (High) (Red Hat CVE, Github Advisory).

The root cause is CWE-93 (Improper Neutralization of CRLF Sequences), introduced in commit c410806c (2012-02-23) within the export_dev_ids() function in src/sg_inq.c. When sg_inq --export processes SCSI device identification data, the SCSI name string designator (type 8, VPD page 0x83) and the ATA T10 vendor-ID subfield are printed using printf("%.*s") without sanitizing embedded control characters. An attacker can embed a newline character in a device-controlled name string, splitting the KEY=VALUE udev output into two lines and injecting an arbitrary udev property — most critically REMOVE_CMD. On systems where default udev rules (e.g., 50-udev-default.rules) invoke sg_inq --export for SCSI device identification and execute REMOVE_CMD on device removal, disconnecting the crafted device triggers root command execution. The upstream fix applies udev-conforming character escaping to the affected fields, matching encoding already used for designator types 0 and 1 (Red Hat CVE, Red Hat Bugzilla, sg3_utils PR#83).

Successful exploitation grants an attacker full root-level command execution on the affected Linux host, resulting in complete compromise of confidentiality, integrity, and availability. Because the injected REMOVE_CMD udev property executes as root when the device is disconnected, the attacker can run arbitrary system commands, install backdoors, exfiltrate sensitive data, or disrupt system availability. The scope is marked as "Changed" in CVSS, reflecting that the vulnerability in sg3_utils impacts the broader system via the udev subsystem (Red Hat CVE, Github Advisory).

1. Prepare a malicious SCSI/USB device: Using a programmable USB device (e.g., a USB Rubber Ducky or custom firmware on a USB-to-SCSI adapter), craft a SCSI device whose VPD page 0x83 SCSI name string designator (type 8) contains an embedded newline character followed by an injected udev property, such as REMOVE_CMD=/path/to/malicious_script.
2. Connect the device to the target system: Physically plug the crafted device into an accessible USB or SCSI port on a system running a vulnerable version of sg3_utils (1.34–1.48) with default udev rules that invoke sg_inq --export.
3. Trigger udev processing: Upon connection, udev automatically invokes sg_inq --export on the new device. The unsanitized output splits into multiple lines due to the embedded newline, injecting the attacker-controlled REMOVE_CMD property into the udev device database.
4. Execute the payload: Disconnect the crafted device. The default udev rule in 50-udev-default.rules reads the REMOVE_CMD property and executes it as root, running the attacker's arbitrary command (e.g., a reverse shell, credential dumper, or persistence mechanism) (Red Hat CVE, Red Hat Bugzilla).

• Logs: Unexpected or anomalous entries in udev logs (/var/log/udev or journalctl -u systemd-udevd) showing REMOVE_CMD properties being set for SCSI/USB devices; sg_inq --export output containing multi-line entries or unexpected KEY=VALUE pairs beyond standard device identifiers.
• File System: Presence of unexpected scripts or binaries in world-writable directories (e.g., /tmp, /dev/shm) that may have been placed by a REMOVE_CMD payload; new cron jobs, systemd units, or SSH authorized keys added around the time of device connection/disconnection events.
• Process: Unusual processes spawned by udevd or as root at the time of device removal (e.g., bash, curl, wget, nc, python) visible in process audit logs (auditd) or ps snapshots.
• Network: Unexpected outbound connections from the host shortly after a USB/SCSI device disconnection event, potentially indicating a reverse shell or data exfiltration attempt.

Preferred remediation: Update sg3_utils to a patched version — Red Hat has released RHSA-2026:50141 (sg3_utils-1.47-10.el9_8.1 for RHEL 9) and RHSA-2026:50142 (sg3_utils-1.48-7.el10_2.1 for RHEL 10). Upstream sg3_utils version 1.49 also includes the fix via PR #83 (RHSA-2026:50141, sg3_utils PR#83).

Workarounds (if patching is not immediately possible):

• Remove or comment out the REMOVE_CMD rule from /lib/udev/rules.d/50-udev-default.rules to prevent command execution on device removal.
• If automatic SCSI device identification is not required, disable the udev rule that invokes sg_inq --export on device connection.
• Restrict physical access to USB and SCSI ports to trusted personnel and devices (Red Hat CVE).

Red Hat rated this vulnerability as "Important" severity and issued security advisories for RHEL 9 and RHEL 10 on August 4, 2026 (RHSA-2026:50141). The upstream reporter is credited as Shaomin Chen, and the fix was contributed by Paul Evans via GitHub PR #83, which was accepted and merged by the sg3_utils maintainer (sg3_utils PR#83). The NixOS community also responded promptly, merging an update to sg3_utils 1.49 in nixpkgs to address the CVE. OpenSUSE similarly backported the fix to their sg3_utils package shortly after the upstream fix was published.