A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade sg3_utilsUpgrade sg3_utils-develUpgrade sg3_utils-libs | Oct 11, 2026 | Aug 4, 2026 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Aug 19, 2026 | Jun 1, 2026 |
| Redhat_linux | — | Upgrade sg3_utils-develUpgrade sg3_utils-debuginfoUpgrade sg3_utils-debugsourceUpgrade sg3_utils-libsUpgrade sg3_utils-libs-debuginfoUpgrade sg3_utils | Jul 30, 2026 | Jun 1, 2026 |
| Rocky_linux | — | Upgrade sg3_utils-develUpgrade sg3_utils-libs-debuginfoUpgrade sg3_utils-libsUpgrade sg3_utilsUpgrade sg3_utils-debuginfoUpgrade sg3_utils-debugsource | Aug 7, 2026 | Aug 6, 2026 |
| Ubuntu | — | Upgrade sg3-utils-udevUpgrade sg3-utils-udev (Ubuntu Pro)Upgrade sg3-utilsUpgrade sg3-utils (Ubuntu Pro) | Oct 7, 2026 | Oct 6, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub