sg3_utils security, bug fix, and enhancement update

An update is available for sg3utils. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The sg3utils packages provide command-line utilities for devices that use th...

sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

Important: Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update

An update for sg3utils is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Important: sg3_utils security, bug fix, and enhancement update

The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...

Important: sg3_utils

Issue Overview: A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary propertie...

CVE-2026-68374

In the Linux kernel, the following vulnerability has been resolved: usb: core: sysfs: add lock to bosdescriptorsread Add a lock to the function bosdescriptorsread. This function accesses udev-bos, which could be simultaneously freed in usbresetandverifydevice, a function that is commonly called i...

CVE-2026-68374 usb: core: sysfs: add lock to bos_descriptors_read()

In the Linux kernel, the following vulnerability has been resolved: usb: core: sysfs: add lock to bosdescriptorsread Add a lock to the function bosdescriptorsread. This function accesses udev-bos, which could be simultaneously freed in usbresetandverifydevice, a function that is commonly called i...

CVE-2026-68374

The CVE-2026-68374 entry concerns the Linux kernel USB core: sysfs bos_descriptors_read(). The root cause is missing synchronization around udev->bos, which can be freed concurrently by usb_reset_and_verify_device() invoked by drivers across the kernel, creating a use-after-free condition. Imp...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.22.0, the URBDRC client used server-supplied interface numbers as array indices without bounds checks, resulting in a out-of-bounds read in libusbudevselectinterface. This vulnerability has been fixed in version...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Revert “i2c: i801: replace acpilock with I2C bus lock” This revertment is associated with the commit f707d6b9e7c18f669adfdb443906d46cfbaaa0c1. Under rare circumstances, multiple udev threads may collect information abo...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.22.0, urbselectinterface could free the device’s MS config upon an error, but subsequent code still dereferenced it, resulting in a use after free in libusbudevselectinterface. This vulnerability has been fixed in...

OESA-2026-3244 sg3_utils security update

The sg3utils package contains utilities that send SCSI commands to devices. As well as devices on transports traditionally associated with SCSI e.g. Fibre Channel FCP, Serial Attached SCSI SAS and the SCSI Parallel InterfaceSPI many other devices use SCSI command sets. ATAPI cd/dvd drives and SAT...

RLSA-2026:50142 Important: sg3_utils security, bug fix, and enhancement update

The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...

RLSA-2026:50141 Important: sg3_utils security, bug fix, and enhancement update

The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...

RockyLinux 9 : sg3_utils (RLSA-2026:50141)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:50141 advisory. sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output conformance...

RockyLinux 10 : sg3_utils (RLSA-2026:50142)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:50142 advisory. sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output conformanc...

sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

ALSA-2026:50142 Important: sg3_utils security, bug fix, and enhancement update

The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...

Important: sg3_utils security, bug fix, and enhancement update

The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...

ALSA-2026:50141 Important: sg3_utils security, bug fix, and enhancement update

The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...