CVE-2026-16313
Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
- Record
CVE-2026-16313- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-93
- Updated
- 2026-11-04
EUVDEUVD-2026-49906
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
- Record
EUVD-2026-49906- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-wqmp-fw94-rpg4
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs...
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
- Record
GHSA-wqmp-fw94-rpg4- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-93
- Updated
- 2026-11-02
NVD
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
- Record
CVE-2026-16313- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-93
- Updated
- 2026-11-04
OSVDEBIAN-CVE-2026-16313
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
- Record
DEBIAN-CVE-2026-16313- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-05
OSVOESA-2026-3244
sg3_utils security update
The sg3_utils package contains utilities that send SCSI commands to devices. As well as devices on transports traditionally associated with SCSI (e.g. Fibre Channel (FCP), Serial Attached SCSI (SAS) and the SCSI Parallel Interface(SPI)) many other devices use SCSI command sets. ATAPI cd/dvd drives and SATA disks that connect via a translation layer or a bridge device are examples of devices that use SCSI command sets.
Security Fix(es):
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.(CVE-2026-16313)
- Record
OESA-2026-3244- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Show 22 moreShow less
OSVRHSA-2026:50141
Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update
- Record
RHSA-2026:50141- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:50142
Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update
- Record
RHSA-2026:50142- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:56130
Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update
- Record
RHSA-2026:56130- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:59397
Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update
- Record
RHSA-2026:59397- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:59555
Red Hat Security Advisory: sg3_utils security update
- Record
RHSA-2026:59555- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:59567
Red Hat Security Advisory: sg3_utils security update
- Record
RHSA-2026:59567- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:59568
Red Hat Security Advisory: sg3_utils security update
- Record
RHSA-2026:59568- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:61260
Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update
- Record
RHSA-2026:61260- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:61261
Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update
- Record
RHSA-2026:61261- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:67157
Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update
- Record
RHSA-2026:67157- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:69124
Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update
- Record
RHSA-2026:69124- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:50141
Important: sg3_utils security, bug fix, and enhancement update
The sg3_utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.
Security Fix(es):
- sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)
Bug Fix(es) and Enhancement(s):
- sg_inq output conformance for SCSI name string and ATA fields [rhel-9.8.z] (JIRA:Rocky Linux-188130)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:50141- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:50142
Important: sg3_utils security, bug fix, and enhancement update
The sg3_utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.
Security Fix(es):
- sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)
Bug Fix(es) and Enhancement(s):
- sg_inq output conformance for SCSI name string and ATA fields [rhel-10.2.z] (JIRA:Rocky Linux-188123)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:50142- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:56130
Important: sg3_utils security, bug fix, and enhancement update
The sg3_utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.
Security Fix(es):
- sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)
Bug Fix(es) and Enhancement(s):
- sg_inq output conformance for SCSI name string and ATA fields [rhel-8.10.z] (JIRA:Rocky Linux-188162)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:56130- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-16313
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
- Record
UBUNTU-CVE-2026-16313- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2026:50141 No score
Important: sg3_utils security, bug fix, and enhancement update
The sg3_utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.
Security Fix(es):
- sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)
Bug Fix(es) and Enhancement(s):
- sg_inq output conformance for SCSI name string and ATA fields [almalinux-9.8.z] (JIRA:AlmaLinux-188130)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:50141- Updated
- 2026-11-02
OSVALSA-2026:50142 No score
Important: sg3_utils security, bug fix, and enhancement update
The sg3_utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.
Security Fix(es):
- sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)
Bug Fix(es) and Enhancement(s):
- sg_inq output conformance for SCSI name string and ATA fields [almalinux-10.2.z] (JIRA:AlmaLinux-188123)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:50142- Updated
- 2026-11-02
OSVALSA-2026:56130 No score
Important: sg3_utils security, bug fix, and enhancement update
The sg3_utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.
Security Fix(es):
- sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)
Bug Fix(es) and Enhancement(s):
- sg_inq output conformance for SCSI name string and ATA fields [almalinux-8.10.z] (JIRA:AlmaLinux-188162)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:56130- Updated
- 2026-11-02
OSVAZL-94311 No score
CVE-2026-16313 affecting package sg3_utils 1.48-1
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
- Record
AZL-94311- Updated
- 2026-11-05
OSVCLSA-2026-1786698186 No score
sg3_utils: Fix of CVE-2026-16313
- Fix CVE-2026-16313 - escape control characters in the VPD 0x83 SCSI name string designator printed by sg_inq --export
- Record
CLSA-2026-1786698186- Updated
- 2026-11-02
OSVCLSA-2026-1788364105 No score
sg3_utils: Fix of CVE-2026-16313
- CVE-2026-16313: escape udev non-conforming characters in the VPD 0x83 SCSI name string designator and the T10 vendor ID ATA subfield printed by sg_inq --export
- Record
CLSA-2026-1788364105- Updated
- 2026-11-02
OSVUSN-8874-1 No score
sg3-utils vulnerability
Shaomin Chen discovered that sg3_utils did not properly sanitize device identification data. An attacker could possibly use this issue to execute arbitrary commands.
- Record
USN-8874-1- Updated
- 2026-11-02
Affected products
- red hat enterprise linux 10
- red hat enterprise linux 10.0 extended update support
- red hat enterprise linux 6
- red hat enterprise linux 7 extended lifecycle support
- red hat enterprise linux 8
- red hat enterprise linux 8.4 advanced mission critical update support
- red hat enterprise linux 8.4 extended update support long-life add-on
- red hat enterprise linux 8.6 advanced mission critical update support
- red hat enterprise linux 8.6 extended update support long-life add-on
- red hat enterprise linux 8.8 telecommunications update service
- red hat enterprise linux 8.8 update services for sap solutions
- red hat enterprise linux 9
Show 12 moreShow less
- red hat enterprise linux 9.2 update services for sap solutions
- red hat enterprise linux 9.4 update services for sap solutions
- red hat enterprise linux 9.6 extended update support
- red hat openshift container platform 4.12
- red hat openshift container platform 4.16
- red hat openshift container platform 4.17
- red hat openshift container platform 4.18
- red hat openshift container platform 4.19
- red hat openshift container platform 4.20
- red hat openshift container platform 4.21
- red hat openshift container platform 4.22
- red hat openshift container platform 5
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sg3_utilsAlmaLinux:9 |
before 1.47-10.el9_8.1 | 1.47-10.el9_8.1 |
sg3_utils-develAlmaLinux:9 |
before 1.47-10.el9_8.1 | 1.47-10.el9_8.1 |
sg3_utils-libsAlmaLinux:9 |
before 1.47-10.el9_8.1 | 1.47-10.el9_8.1 |
sg3_utilsAlmaLinux:10 |
before 1.48-7.el10_2.1 | 1.48-7.el10_2.1 |
sg3_utils-develAlmaLinux:10 |
before 1.48-7.el10_2.1 | 1.48-7.el10_2.1 |
sg3_utils-libsAlmaLinux:10 |
before 1.48-7.el10_2.1 | 1.48-7.el10_2.1 |
sg3_utilsAlmaLinux:8 |
before 1.44-6.el8_10.1 | 1.44-6.el8_10.1 |
sg3_utils-develAlmaLinux:8 |
before 1.44-6.el8_10.1 | 1.44-6.el8_10.1 |
sg3_utils-libsAlmaLinux:8 |
before 1.44-6.el8_10.1 | 1.44-6.el8_10.1 |
sg3_utilsAzure Linux:3 |
through 1.48-1 | None known |
Show 108 moreShow less
| Package | Affected | Fixed |
|---|---|---|
sg3_utilsTuxCare:AlmaLinux:9.6 |
before 1.47-10.el9.tuxcare.els1 | 1.47-10.el9.tuxcare.els1 |
sg3_utils-develTuxCare:AlmaLinux:9.6 |
before 1.47-10.el9.tuxcare.els1 | 1.47-10.el9.tuxcare.els1 |
sg3_utils-libsTuxCare:AlmaLinux:9.6 |
before 1.47-10.el9.tuxcare.els1 | 1.47-10.el9.tuxcare.els1 |
sg3_utilsTuxCare:AlmaLinux:9.2 |
before 1.47-9.el9.tuxcare.els1 | 1.47-9.el9.tuxcare.els1 |
sg3_utils-develTuxCare:AlmaLinux:9.2 |
before 1.47-9.el9.tuxcare.els1 | 1.47-9.el9.tuxcare.els1 |
sg3_utils-libsTuxCare:AlmaLinux:9.2 |
before 1.47-9.el9.tuxcare.els1 | 1.47-9.el9.tuxcare.els1 |
sg3-utilsDebian:12 |
All versions, plus listed versions 1.46-31.46-3.11.48-11.48-21.48-31.48-3~deb13u11.48-4 |
None known |
sg3-utilsDebian:13 |
All versions, plus listed versions 1.48-21.48-31.48-3~deb13u11.48-4 |
None known |
sg3-utilsDebian:14 |
before 1.48-4, plus listed versions 1.48-21.48-31.48-3~deb13u1 |
1.48-4 |
sg3_utilsopenEuler:24.03-LTS-SP3 |
before 1.48-4.oe2403sp3 | 1.48-4.oe2403sp3 |
sg3_utilsopenEuler:24.03-LTS-SP4 |
before 1.48-4.oe2403sp4 | 1.48-4.oe2403sp4 |
sg3_utilsopenEuler:20.03-LTS-SP4 |
before 1.45-14.oe2003sp4 | 1.45-14.oe2003sp4 |
sg3_utilsopenEuler:22.03-LTS-SP4 |
before 1.46-10.oe2203sp4 | 1.46-10.oe2203sp4 |
sg3_utilsopenEuler:24.03-LTS-SP1 |
before 1.48-4.oe2403sp1 | 1.48-4.oe2403sp1 |
sg3_utilsRed Hat:enterprise_linux:9::baseos |
before 0:1.47-10.el9_8.1 | 0:1.47-10.el9_8.1 |
sg3_utils-debuginfoRed Hat:enterprise_linux:9::baseos |
before 0:1.47-10.el9_8.1 | 0:1.47-10.el9_8.1 |
sg3_utils-debugsourceRed Hat:enterprise_linux:9::baseos |
before 0:1.47-10.el9_8.1 | 0:1.47-10.el9_8.1 |
sg3_utils-libsRed Hat:enterprise_linux:9::baseos |
before 0:1.47-10.el9_8.1 | 0:1.47-10.el9_8.1 |
sg3_utils-libs-debuginfoRed Hat:enterprise_linux:9::baseos |
before 0:1.47-10.el9_8.1 | 0:1.47-10.el9_8.1 |
sg3_utils-debuginfoRed Hat:enterprise_linux:9::crb |
before 0:1.47-10.el9_8.1 | 0:1.47-10.el9_8.1 |
sg3_utils-debugsourceRed Hat:enterprise_linux:9::crb |
before 0:1.47-10.el9_8.1 | 0:1.47-10.el9_8.1 |
sg3_utils-develRed Hat:enterprise_linux:9::crb |
before 0:1.47-10.el9_8.1 | 0:1.47-10.el9_8.1 |
sg3_utils-libs-debuginfoRed Hat:enterprise_linux:9::crb |
before 0:1.47-10.el9_8.1 | 0:1.47-10.el9_8.1 |
sg3_utilsRed Hat:enterprise_linux:10.2 |
before 0:1.48-7.el10_2.1 | 0:1.48-7.el10_2.1 |
sg3_utils-debuginfoRed Hat:enterprise_linux:10.2 |
before 0:1.48-7.el10_2.1 | 0:1.48-7.el10_2.1 |
sg3_utils-debugsourceRed Hat:enterprise_linux:10.2 |
before 0:1.48-7.el10_2.1 | 0:1.48-7.el10_2.1 |
sg3_utils-libsRed Hat:enterprise_linux:10.2 |
before 0:1.48-7.el10_2.1 | 0:1.48-7.el10_2.1 |
sg3_utils-libs-debuginfoRed Hat:enterprise_linux:10.2 |
before 0:1.48-7.el10_2.1 | 0:1.48-7.el10_2.1 |
sg3_utils-develRed Hat:enterprise_linux:10.2 |
before 0:1.48-7.el10_2.1 | 0:1.48-7.el10_2.1 |
sg3_utilsRed Hat:enterprise_linux:8::baseos |
before 0:1.44-6.el8_10.1 | 0:1.44-6.el8_10.1 |
sg3_utils-debuginfoRed Hat:enterprise_linux:8::baseos |
before 0:1.44-6.el8_10.1 | 0:1.44-6.el8_10.1 |
sg3_utils-debugsourceRed Hat:enterprise_linux:8::baseos |
before 0:1.44-6.el8_10.1 | 0:1.44-6.el8_10.1 |
sg3_utils-libsRed Hat:enterprise_linux:8::baseos |
before 0:1.44-6.el8_10.1 | 0:1.44-6.el8_10.1 |
sg3_utils-libs-debuginfoRed Hat:enterprise_linux:8::baseos |
before 0:1.44-6.el8_10.1 | 0:1.44-6.el8_10.1 |
sg3_utils-debuginfoRed Hat:enterprise_linux:8::crb |
before 0:1.44-6.el8_10.1 | 0:1.44-6.el8_10.1 |
sg3_utils-debugsourceRed Hat:enterprise_linux:8::crb |
before 0:1.44-6.el8_10.1 | 0:1.44-6.el8_10.1 |
sg3_utils-develRed Hat:enterprise_linux:8::crb |
before 0:1.44-6.el8_10.1 | 0:1.44-6.el8_10.1 |
sg3_utils-libs-debuginfoRed Hat:enterprise_linux:8::crb |
before 0:1.44-6.el8_10.1 | 0:1.44-6.el8_10.1 |
sg3_utilsRed Hat:rhel_eus:9.6::baseos |
before 0:1.47-10.el9_6.2 | 0:1.47-10.el9_6.2 |
sg3_utils-debuginfoRed Hat:rhel_eus:9.6::baseos |
before 0:1.47-10.el9_6.2 | 0:1.47-10.el9_6.2 |
sg3_utils-debugsourceRed Hat:rhel_eus:9.6::baseos |
before 0:1.47-10.el9_6.2 | 0:1.47-10.el9_6.2 |
sg3_utils-libsRed Hat:rhel_eus:9.6::baseos |
before 0:1.47-10.el9_6.2 | 0:1.47-10.el9_6.2 |
sg3_utils-libs-debuginfoRed Hat:rhel_eus:9.6::baseos |
before 0:1.47-10.el9_6.2 | 0:1.47-10.el9_6.2 |
sg3_utils-debuginfoRed Hat:rhel_eus:9.6::crb |
before 0:1.47-10.el9_6.2 | 0:1.47-10.el9_6.2 |
sg3_utils-debugsourceRed Hat:rhel_eus:9.6::crb |
before 0:1.47-10.el9_6.2 | 0:1.47-10.el9_6.2 |
sg3_utils-develRed Hat:rhel_eus:9.6::crb |
before 0:1.47-10.el9_6.2 | 0:1.47-10.el9_6.2 |
sg3_utils-libs-debuginfoRed Hat:rhel_eus:9.6::crb |
before 0:1.47-10.el9_6.2 | 0:1.47-10.el9_6.2 |
sg3_utilsRed Hat:rhel_aus:8.4::baseos |
before 0:1.44-5.el8_4.1 | 0:1.44-5.el8_4.1 |
sg3_utils-debuginfoRed Hat:rhel_aus:8.4::baseos |
before 0:1.44-5.el8_4.1 | 0:1.44-5.el8_4.1 |
sg3_utils-debugsourceRed Hat:rhel_aus:8.4::baseos |
before 0:1.44-5.el8_4.1 | 0:1.44-5.el8_4.1 |
sg3_utils-libsRed Hat:rhel_aus:8.4::baseos |
before 0:1.44-5.el8_4.1 | 0:1.44-5.el8_4.1 |
sg3_utils-libs-debuginfoRed Hat:rhel_aus:8.4::baseos |
before 0:1.44-5.el8_4.1 | 0:1.44-5.el8_4.1 |
sg3_utilsRed Hat:rhel_eus_long_life:8.4::baseos |
before 0:1.44-5.el8_4.1 | 0:1.44-5.el8_4.1 |
sg3_utils-debuginfoRed Hat:rhel_eus_long_life:8.4::baseos |
before 0:1.44-5.el8_4.1 | 0:1.44-5.el8_4.1 |
sg3_utils-debugsourceRed Hat:rhel_eus_long_life:8.4::baseos |
before 0:1.44-5.el8_4.1 | 0:1.44-5.el8_4.1 |
sg3_utils-libsRed Hat:rhel_eus_long_life:8.4::baseos |
before 0:1.44-5.el8_4.1 | 0:1.44-5.el8_4.1 |
sg3_utils-libs-debuginfoRed Hat:rhel_eus_long_life:8.4::baseos |
before 0:1.44-5.el8_4.1 | 0:1.44-5.el8_4.1 |
sg3_utilsRed Hat:rhel_aus:8.6::baseos |
before 0:1.44-5.el8_6.1 | 0:1.44-5.el8_6.1 |
sg3_utils-debuginfoRed Hat:rhel_aus:8.6::baseos |
before 0:1.44-5.el8_6.1 | 0:1.44-5.el8_6.1 |
sg3_utils-debugsourceRed Hat:rhel_aus:8.6::baseos |
before 0:1.44-5.el8_6.1 | 0:1.44-5.el8_6.1 |
sg3_utils-libsRed Hat:rhel_aus:8.6::baseos |
before 0:1.44-5.el8_6.1 | 0:1.44-5.el8_6.1 |
sg3_utils-libs-debuginfoRed Hat:rhel_aus:8.6::baseos |
before 0:1.44-5.el8_6.1 | 0:1.44-5.el8_6.1 |
sg3_utilsRed Hat:rhel_eus_long_life:8.6::baseos |
before 0:1.44-5.el8_6.1 | 0:1.44-5.el8_6.1 |
sg3_utils-debuginfoRed Hat:rhel_eus_long_life:8.6::baseos |
before 0:1.44-5.el8_6.1 | 0:1.44-5.el8_6.1 |
sg3_utils-debugsourceRed Hat:rhel_eus_long_life:8.6::baseos |
before 0:1.44-5.el8_6.1 | 0:1.44-5.el8_6.1 |
sg3_utils-libsRed Hat:rhel_eus_long_life:8.6::baseos |
before 0:1.44-5.el8_6.1 | 0:1.44-5.el8_6.1 |
sg3_utils-libs-debuginfoRed Hat:rhel_eus_long_life:8.6::baseos |
before 0:1.44-5.el8_6.1 | 0:1.44-5.el8_6.1 |
sg3_utilsRed Hat:rhel_e4s:8.8::baseos |
before 0:1.44-6.el8_8.1 | 0:1.44-6.el8_8.1 |
sg3_utils-debuginfoRed Hat:rhel_e4s:8.8::baseos |
before 0:1.44-6.el8_8.1 | 0:1.44-6.el8_8.1 |
sg3_utils-debugsourceRed Hat:rhel_e4s:8.8::baseos |
before 0:1.44-6.el8_8.1 | 0:1.44-6.el8_8.1 |
sg3_utils-libsRed Hat:rhel_e4s:8.8::baseos |
before 0:1.44-6.el8_8.1 | 0:1.44-6.el8_8.1 |
sg3_utils-libs-debuginfoRed Hat:rhel_e4s:8.8::baseos |
before 0:1.44-6.el8_8.1 | 0:1.44-6.el8_8.1 |
sg3_utilsRed Hat:rhel_tus:8.8::baseos |
before 0:1.44-6.el8_8.1 | 0:1.44-6.el8_8.1 |
sg3_utils-debuginfoRed Hat:rhel_tus:8.8::baseos |
before 0:1.44-6.el8_8.1 | 0:1.44-6.el8_8.1 |
sg3_utils-debugsourceRed Hat:rhel_tus:8.8::baseos |
before 0:1.44-6.el8_8.1 | 0:1.44-6.el8_8.1 |
sg3_utils-libsRed Hat:rhel_tus:8.8::baseos |
before 0:1.44-6.el8_8.1 | 0:1.44-6.el8_8.1 |
sg3_utils-libs-debuginfoRed Hat:rhel_tus:8.8::baseos |
before 0:1.44-6.el8_8.1 | 0:1.44-6.el8_8.1 |
sg3_utilsRed Hat:rhel_e4s:9.4::baseos |
before 0:1.47-9.el9_4.1 | 0:1.47-9.el9_4.1 |
sg3_utils-debuginfoRed Hat:rhel_e4s:9.4::baseos |
before 0:1.47-9.el9_4.1 | 0:1.47-9.el9_4.1 |
sg3_utils-debugsourceRed Hat:rhel_e4s:9.4::baseos |
before 0:1.47-9.el9_4.1 | 0:1.47-9.el9_4.1 |
sg3_utils-libsRed Hat:rhel_e4s:9.4::baseos |
before 0:1.47-9.el9_4.1 | 0:1.47-9.el9_4.1 |
sg3_utils-libs-debuginfoRed Hat:rhel_e4s:9.4::baseos |
before 0:1.47-9.el9_4.1 | 0:1.47-9.el9_4.1 |
sg3_utilsRed Hat:rhel_e4s:9.2::baseos |
before 0:1.47-9.el9_2.1 | 0:1.47-9.el9_2.1 |
sg3_utils-debuginfoRed Hat:rhel_e4s:9.2::baseos |
before 0:1.47-9.el9_2.1 | 0:1.47-9.el9_2.1 |
sg3_utils-debugsourceRed Hat:rhel_e4s:9.2::baseos |
before 0:1.47-9.el9_2.1 | 0:1.47-9.el9_2.1 |
sg3_utils-libsRed Hat:rhel_e4s:9.2::baseos |
before 0:1.47-9.el9_2.1 | 0:1.47-9.el9_2.1 |
sg3_utils-libs-debuginfoRed Hat:rhel_e4s:9.2::baseos |
before 0:1.47-9.el9_2.1 | 0:1.47-9.el9_2.1 |
sg3_utilsRed Hat:rhel_els:7 |
before 1:1.37-20.el7_9 | 1:1.37-20.el7_9 |
sg3_utils-debuginfoRed Hat:rhel_els:7 |
before 1:1.37-20.el7_9 | 1:1.37-20.el7_9 |
sg3_utils-libsRed Hat:rhel_els:7 |
before 1:1.37-20.el7_9 | 1:1.37-20.el7_9 |
sg3_utils-develRed Hat:rhel_els:7 |
before 1:1.37-20.el7_9 | 1:1.37-20.el7_9 |
sg3_utilsRed Hat:enterprise_linux_eus:10.0 |
before 0:1.48-7.el10_0.2 | 0:1.48-7.el10_0.2 |
sg3_utils-debuginfoRed Hat:enterprise_linux_eus:10.0 |
before 0:1.48-7.el10_0.2 | 0:1.48-7.el10_0.2 |
sg3_utils-debugsourceRed Hat:enterprise_linux_eus:10.0 |
before 0:1.48-7.el10_0.2 | 0:1.48-7.el10_0.2 |
sg3_utils-libsRed Hat:enterprise_linux_eus:10.0 |
before 0:1.48-7.el10_0.2 | 0:1.48-7.el10_0.2 |
sg3_utils-libs-debuginfoRed Hat:enterprise_linux_eus:10.0 |
before 0:1.48-7.el10_0.2 | 0:1.48-7.el10_0.2 |
sg3_utils-develRed Hat:enterprise_linux_eus:10.0 |
before 0:1.48-7.el10_0.2 | 0:1.48-7.el10_0.2 |
sg3_utilsRocky Linux:9 |
before 0:1.47-10.el9_8.1 | 0:1.47-10.el9_8.1 |
sg3_utilsRocky Linux:10 |
before 0:1.48-7.el10_2.1 | 0:1.48-7.el10_2.1 |
sg3_utilsRocky Linux:8 |
before 0:1.44-6.el8_10.1 | 0:1.44-6.el8_10.1 |
sg3-utilsUbuntu:Pro:14.04:LTS |
before 1.36-1ubuntu1+esm1, plus listed versions 1.36-11.36-1ubuntu1 |
1.36-1ubuntu1+esm1 |
sg3-utilsUbuntu:Pro:16.04:LTS |
before 1.40-0ubuntu1+esm1, plus listed versions 1.40-0ubuntu1 |
1.40-0ubuntu1+esm1 |
sg3-utilsUbuntu:Pro:18.04:LTS |
before 1.42-2ubuntu1.18.04.2+esm1, plus listed versions 1.42-2ubuntu11.42-2ubuntu1.18.04.11.42-2ubuntu1.18.04.2 |
1.42-2ubuntu1.18.04.2+esm1 |
sg3-utilsUbuntu:Pro:20.04:LTS |
before 1.44-1ubuntu2+esm1, plus listed versions 1.44-1ubuntu11.44-1ubuntu2 |
1.44-1ubuntu2+esm1 |
sg3-utilsUbuntu:22.04:LTS |
before 1.46-1ubuntu0.22.04.2, plus listed versions 1.45-1ubuntu21.45-1ubuntu31.46-11.46-1build11.46-1ubuntu0.22.04.1 |
1.46-1ubuntu0.22.04.2 |
sg3-utilsUbuntu:24.04:LTS |
before 1.46-3ubuntu4.1, plus listed versions 1.46-3ubuntu21.46-3ubuntu31.46-3ubuntu4 |
1.46-3ubuntu4.1 |
sg3-utilsUbuntu:26.10 |
before 1.48-3ubuntu5, plus listed versions 1.48-3ubuntu31.48-3ubuntu4 |
1.48-3ubuntu5 |
sg3-utilsUbuntu:26.04:LTS |
before 1.48-3ubuntu3.2, plus listed versions 1.48-2ubuntu11.48-3ubuntu11.48-3ubuntu21.48-3ubuntu31.48-3ubuntu3.1 |
1.48-3ubuntu3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | CVE List, EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-16313 is a high vulnerability (CVSS 7.6) in Red Hat Enterprise Linux 10, published July 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in sg3_utils 1.47-10.el9_8.1.
References
access.redhat.com/errata/RHSA-2026:50141
Show 44 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2502845
github.com/doug-gilbert/sg3_utils/pull/83
nvd.nist.gov/vuln/detail/CVE-2026-16313
errata.almalinux.org/9/ALSA-2026-50141.html
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1786698186.html
security-tracker.debian.org/tracker/CVE-2026-16313
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3244
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50141.json
cve.org/CVERecord?id=CVE-2026-16313
errata.rockylinux.org/RLSA-2026:50141
ubuntu.com/security/CVE-2026-16313