HIGH Introduced in 6.15
vhost-scsi FeatureChange Deref
CVE-2026-74702
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
KernelScan AI6.1MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates each command's protection scatterlist array (prot_sgl) according to the acknowledged VIRTIO_SCSI_F_T10_PI bit. The command pools are not rebuilt when VHOST_SET_FEATURES changes that bit later. Although virtio feature bits must not change after feature negotiation, vhost_scsi_set_features() currently accepts such a request after the endpoint is active and updates acked_features. Enabling T10-PI after endpoint setup therefore leaves prot_sgl NULL while the I/O path follows the new feature bit. For a 129-page protection payload, vhost_scsi_mapal() passes the missing first chunk to sg_alloc_table_chained(): sg_alloc_table_chained(table, 129, first_chunk=NULL, nents_first_chunk=inline_sg_cnt) sg_pool_index() then hits: BUG_ON(nents > SG_CHUNK_SIZE); /* 129 > 128 */ The kernel reported the following call trace and register state: Call Trace: <TASK> ? __sg_alloc_table+0x1d8/0x250 ? __pfx_vhost_run_work_list+0x10/0x10 [vhost] sg_alloc_table_chained+0x59/0xf0 ? __pfx_sg_pool_alloc+0x10/0x10 ? vhost_scsi_calc_sgls.constprop.0+0x43/0x60 [vhost_scsi] vhost_scsi_handle_vq+0xf02/0x1700 [vhost_scsi] ? __pfx_vhost_scsi_handle_vq+0x10/0x10 [vhost_scsi] vhost_scsi_handle_kick+0x37/0x50 [vhost_scsi] vhost_run_work_list+0x8e/0xd0 [vhost] vhost_task_fn+0xe1/0x210 ret_from_fork+0x348/0x540 </TASK> RIP: 0010:0x4 CR2 = 0x4 RSP: 0018:ffffc90000dbf940 EFLAGS: 00010202 RAX: ffffffff82396810 RBX: ffff88811dc28b80 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000081 VHOST_F_LOG_ALL is a vhost-specific runtime feature and remains the only exception. Reject changes to any feature other than VHOST_F_LOG_ALL while the endpoint is active. This preserves the existing runtime log toggle while preventing feature-dependent command resources and data-path state from becoming inconsistent. Userspace must clear the endpoint before changing any other negotiated feature and set the endpoint up again afterward.
02KernelScan AI Analysis
Risk summary
A malicious VM guest can trigger a host kernel panic by exploiting inconsistent state in the vhost-scsi subsystem. When virtio-scsi feature bits (specifically T10-PI) are changed after endpoint setup, the host kernel dereferences a NULL pointer and hits a BUG_ON, crashing the host. This affects any host running KVM/QEMU with vhost-scsi-backed virtio-scsi devices and untrusted or potentially compromised guests.
Vulnerability analysis
The vhost-scsi subsystem accepts feature-bit changes via ioctl after an endpoint has already been configured, but command resources such as protection scatterlists are only allocated during endpoint setup based on the features active at that time. If the T10-PI feature is enabled after setup, the I/O path follows the new feature bit and attempts to use protection scatterlist arrays that were never allocated, passing a NULL pointer into the scatterlist allocation chain and triggering a kernel BUG_ON and NULL dereference that panics the host. The fix rejects any feature change other than the runtime logging toggle while the endpoint is active, requiring userspace to tear down and re-establish the endpoint to change negotiated features. A malicious VM guest can reach this path through normal virtio-scsi feature negotiation and I/O submission, causing a host-wide denial of service without needing any host-level privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.15 | 6.18.45 | a06e4611d455 |
| 7.1 | 6.15 | 7.1.9 | 9a3eb77a612f |
| mainline | 6.15 | 7.2 | 42bc45df5905 |