The sg3_utils package contains a flaw in the sg_inq command when used with the --export option. It fails to sanitize control characters in SCSI device name strings, specifically allowing newline characters to inject properties into the udev device database. This vulnerability (CVE-2026-16313) could be exploited by an attacker who can present a malicious SCSI device, enabling arbitrary command execution with root privileges when the device is disconnected. The CVSS 3.1 vector indicates a high severity with partial attack vector (physical), low attack complexity, no privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with physical access to present a crafted SCSI device that can inject malicious properties into the udev device database, leading to arbitrary command execution as root when the device is disconnected. This compromises system confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory linked does not explicitly mention a fix or workaround. Until a patch or official fix is available, restrict physical access to systems and avoid connecting untrusted SCSI devices. Monitor vendor channels for updates.