GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38074 (GCVE-0-2025-38074)

Vulnerability from cvelistv5 – Published: 2025-06-18 09:33 – Updated: 2026-08-05 11:59
VLAI
Title
vhost-scsi: protect vq->log_used with vq->mutex
Summary
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: protect vq->log_used with vq->mutex The vhost-scsi completion path may access vq->log_base when vq->log_used is already set to false. vhost-thread QEMU-thread vhost_scsi_complete_cmd_work() -> vhost_add_used() -> vhost_add_used_n() if (unlikely(vq->log_used)) QEMU disables vq->log_used via VHOST_SET_VRING_ADDR. mutex_lock(&vq->mutex); vq->log_used = false now! mutex_unlock(&vq->mutex); QEMU gfree(vq->log_base) log_used() -> log_write(vq->log_base) Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be reclaimed via gfree(). As a result, this causes invalid memory writes to QEMU userspace. The control queue path has the same issue.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 057cbf49a1f08297877e46c82f707b1bfea806a8 , < 80cf68489681c165ded460930e391b1eb37b5f6f (git)
Affected: 057cbf49a1f08297877e46c82f707b1bfea806a8 , < 8312a1ccff1566f375191a89b9ba71b6eb48a8cd (git)
Affected: 057cbf49a1f08297877e46c82f707b1bfea806a8 , < 59614c5acf6688f7af3c245d359082c0e9e53117 (git)
Affected: 057cbf49a1f08297877e46c82f707b1bfea806a8 , < ca85c2d0db5f8309832be45858b960d933c2131c (git)
Affected: 057cbf49a1f08297877e46c82f707b1bfea806a8 , < bd8c9404e44adb9f6219c09b3409a61ab7ce3427 (git)
Affected: 057cbf49a1f08297877e46c82f707b1bfea806a8 , < c0039e3afda29be469d29b3013d7f9bdee136834 (git)
Affected: 057cbf49a1f08297877e46c82f707b1bfea806a8 , < f591cf9fce724e5075cc67488c43c6e39e8cbe27 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.6
Unaffected: 0 , < 3.6 (semver)
Unaffected: 5.10.240 , ≤ 5.10.* (semver)
Unaffected: 5.15.189 , ≤ 5.15.* (semver)
Unaffected: 6.1.146 , ≤ 6.1.* (semver)
Unaffected: 6.6.93 , ≤ 6.6.* (semver)
Unaffected: 6.12.31 , ≤ 6.12.* (semver)
Unaffected: 6.14.9 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:33:42.169Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/vhost/scsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "80cf68489681c165ded460930e391b1eb37b5f6f",
              "status": "affected",
              "version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
              "versionType": "git"
            },
            {
              "lessThan": "8312a1ccff1566f375191a89b9ba71b6eb48a8cd",
              "status": "affected",
              "version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
              "versionType": "git"
            },
            {
              "lessThan": "59614c5acf6688f7af3c245d359082c0e9e53117",
              "status": "affected",
              "version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
              "versionType": "git"
            },
            {
              "lessThan": "ca85c2d0db5f8309832be45858b960d933c2131c",
              "status": "affected",
              "version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
              "versionType": "git"
            },
            {
              "lessThan": "bd8c9404e44adb9f6219c09b3409a61ab7ce3427",
              "status": "affected",
              "version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
              "versionType": "git"
            },
            {
              "lessThan": "c0039e3afda29be469d29b3013d7f9bdee136834",
              "status": "affected",
              "version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
              "versionType": "git"
            },
            {
              "lessThan": "f591cf9fce724e5075cc67488c43c6e39e8cbe27",
              "status": "affected",
              "version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/vhost/scsi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.6"
            },
            {
              "lessThan": "3.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.189",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.93",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.31",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.9",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: protect vq-\u003elog_used with vq-\u003emutex\n\nThe vhost-scsi completion path may access vq-\u003elog_base when vq-\u003elog_used is\nalready set to false.\n\n    vhost-thread                       QEMU-thread\n\nvhost_scsi_complete_cmd_work()\n-\u003e vhost_add_used()\n   -\u003e vhost_add_used_n()\n      if (unlikely(vq-\u003elog_used))\n                                      QEMU disables vq-\u003elog_used\n                                      via VHOST_SET_VRING_ADDR.\n                                      mutex_lock(\u0026vq-\u003emutex);\n                                      vq-\u003elog_used = false now!\n                                      mutex_unlock(\u0026vq-\u003emutex);\n\n\t\t\t\t      QEMU gfree(vq-\u003elog_base)\n        log_used()\n        -\u003e log_write(vq-\u003elog_base)\n\nAssuming the VMM is QEMU. The vq-\u003elog_base is from QEMU userpace and can be\nreclaimed via gfree(). As a result, this causes invalid memory writes to\nQEMU userspace.\n\nThe control queue path has the same issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - vhost-scsi is a host-kernel backend driven by a guest VM through its virtqueues and by the VMM through /dev/vhost-scsi ioctls; there is no network-facing path, so the attacker acts from a local context (inside a guest on the host, or a local host process holding the vhost fd).\nAC:L - The attacker controls both sides of the race \u2014 a continuous stream of guest SCSI I/O keeps the unlocked completion worker running, and a guest-initiated virtio device reset forces QEMU\u0027s vhost_dev_stop() to clear log_used and free the log bitmap; the window is wide because the entire completion loop ran with no lock at all, and each command issues multiple log_write() calls.\nPR:L - The attacker needs to be an authorized guest tenant driving the virtio-scsi device (or a local host process with the vhost-scsi fd); no host root or elevated host capability is required, and ordinary unprivileged guest I/O suffices to keep the completion path armed.\nUI:N - No victim action is needed \u2014 the guest can itself force the log-teardown path via a virtio device reset or feature renegotiation while completions are in flight, and the migration-end teardown is a routine automated host operation, not a tricked user action.\nS:C - The vulnerable component is the host kernel\u0027s vhost-scsi driver, but the corrupted resource is the host VMM (QEMU) userspace address space, reached from inside a guest \u2014 the guest confinement boundary is crossed, matching the guest-to-host escape case.\nC:H - Guest-influenced bit-sets at attacker-chosen offsets from a stale log_base corrupt live QEMU heap objects (pointers, lengths, migration bitmap state), which is leverageable to disclose host memory back into the guest.\nI:H - This is an out-of-bounds/use-after-free write into the host VMM process with attacker-controlled offset and multiplicity, enabling corruption of QEMU control structures and hence control-flow hijack, and it silently corrupts the migration dirty bitmap so migrated guest state is written incorrectly.\nA:H - Corrupting glib heap metadata aborts QEMU and terminates the VM, migrations fail or complete with corrupt state, and set_bit_to_user()\u0027s BUG_ON(r != 1) can be reached when the stale log page is no longer pinnable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:14.881Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/80cf68489681c165ded460930e391b1eb37b5f6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8312a1ccff1566f375191a89b9ba71b6eb48a8cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/59614c5acf6688f7af3c245d359082c0e9e53117"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca85c2d0db5f8309832be45858b960d933c2131c"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd8c9404e44adb9f6219c09b3409a61ab7ce3427"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0039e3afda29be469d29b3013d7f9bdee136834"
        },
        {
          "url": "https://git.kernel.org/stable/c/f591cf9fce724e5075cc67488c43c6e39e8cbe27"
        }
      ],
      "title": "vhost-scsi: protect vq-\u003elog_used with vq-\u003emutex",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38074",
    "datePublished": "2025-06-18T09:33:50.006Z",
    "dateReserved": "2025-04-16T04:51:23.980Z",
    "dateUpdated": "2026-08-05T11:59:14.881Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38074",
      "date": "2026-09-19",
      "epss": "0.00198",
      "percentile": "0.09957"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:56:21.000Z",
      "cve": "CVE-2025-38074",
      "id": "msrc_CVE-2025-38074",
      "initial_release_date": "2025-06-02T00:00:00.000Z",
      "product_status:known_not_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "vhost-scsi: protect vq-\u003elog_used with vq-\u003emutex",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38074.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/vhost/scsi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "80cf68489681c165ded460930e391b1eb37b5f6f",
                    "status": "affected",
                    "version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8312a1ccff1566f375191a89b9ba71b6eb48a8cd",
                    "status": "affected",
                    "version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "59614c5acf6688f7af3c245d359082c0e9e53117",
                    "status": "affected",
                    "version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ca85c2d0db5f8309832be45858b960d933c2131c",
                    "status": "affected",
                    "version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bd8c9404e44adb9f6219c09b3409a61ab7ce3427",
                    "status": "affected",
                    "version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c0039e3afda29be469d29b3013d7f9bdee136834",
                    "status": "affected",
                    "version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f591cf9fce724e5075cc67488c43c6e39e8cbe27",
                    "status": "affected",
                    "version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/vhost/scsi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.6"
                  },
                  {
                    "lessThan": "3.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.240",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.189",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.146",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.31",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.14.*",
                    "status": "unaffected",
                    "version": "6.14.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.15",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AA282C17-D5E0-4F16-9509-45FAAEFD652E",
                    "versionEndExcluding": "5.10.240",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3CE0FB9A-DBE8-48B6-BF6E-3C724A4991E3",
                    "versionEndExcluding": "5.15.189",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D8DA1166-5C95-475E-BF65-1DF621968E96",
                    "versionEndExcluding": "6.1.146",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "50A4A9DE-24AB-4FB4-AACD-85D8EABB0571",
                    "versionEndExcluding": "6.6.93",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1AE98841-5774-4B45-A81C-2D188DB7E5C3",
                    "versionEndExcluding": "6.12.31",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A9B72DD1-715C-4101-A720-1C8D70044C06",
                    "versionEndExcluding": "6.14.9",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: protect vq-\u003elog_used with vq-\u003emutex\n\nThe vhost-scsi completion path may access vq-\u003elog_base when vq-\u003elog_used is\nalready set to false.\n\n    vhost-thread                       QEMU-thread\n\nvhost_scsi_complete_cmd_work()\n-\u003e vhost_add_used()\n   -\u003e vhost_add_used_n()\n      if (unlikely(vq-\u003elog_used))\n                                      QEMU disables vq-\u003elog_used\n                                      via VHOST_SET_VRING_ADDR.\n                                      mutex_lock(\u0026vq-\u003emutex);\n                                      vq-\u003elog_used = false now!\n                                      mutex_unlock(\u0026vq-\u003emutex);\n\n\t\t\t\t      QEMU gfree(vq-\u003elog_base)\n        log_used()\n        -\u003e log_write(vq-\u003elog_base)\n\nAssuming the VMM is QEMU. The vq-\u003elog_base is from QEMU userpace and can be\nreclaimed via gfree(). As a result, this causes invalid memory writes to\nQEMU userspace.\n\nThe control queue path has the same issue."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vhost-scsi: proteger vq-\u0026gt;log_used con vq-\u0026gt;mutex La ruta de finalizaci\u00f3n de vhost-scsi puede acceder a vq-\u0026gt;log_base cuando vq-\u0026gt;log_used ya est\u00e1 configurado como falso. vhost-thread QEMU-thread vhost_scsi_complete_cmd_work() -\u0026gt; vhost_add_used() -\u0026gt; vhost_add_used_n() if (unlikely(vq-\u0026gt;log_used)) QEMU deshabilita vq-\u0026gt;log_used mediante VHOST_SET_VRING_ADDR. mutex_lock(\u0026amp;vq-\u0026gt;mutex); vq-\u0026gt;log_used = false now! mutex_unlock(\u0026amp;vq-\u0026gt;mutex); QEMU gfree(vq-\u0026gt;log_base) log_used() -\u0026gt; log_write(vq-\u0026gt;log_base) Suponiendo que el VMM es QEMU. La ruta vq-\u0026gt;log_base proviene del espacio de usuario de QEMU y se puede recuperar mediante gfree(). Como resultado, esto provoca escrituras de memoria no v\u00e1lidas en el espacio de usuario de QEMU. La ruta de la cola de control presenta el mismo problema."
          }
        ],
        "id": "CVE-2025-38074",
        "lastModified": "2026-07-30T06:22:48.127",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-06-18T10:15:40.850",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/59614c5acf6688f7af3c245d359082c0e9e53117"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/80cf68489681c165ded460930e391b1eb37b5f6f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8312a1ccff1566f375191a89b9ba71b6eb48a8cd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bd8c9404e44adb9f6219c09b3409a61ab7ce3427"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c0039e3afda29be469d29b3013d7f9bdee136834"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ca85c2d0db5f8309832be45858b960d933c2131c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f591cf9fce724e5075cc67488c43c6e39e8cbe27"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:15:09+00:00",
      "cve": "CVE-2025-38074",
      "id": "CVE-2025-38074",
      "initial_release_date": "2025-06-18T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vhost-scsi: protect vq-\u003elog_used with vq-\u003emutex",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38074.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.