GHSA-R9HQ-6X72-7Q3J
Vulnerability from github – Published: 2026-08-22 18:30 – Updated: 2026-08-25 06:31In the Linux kernel, the following vulnerability has been resolved:
vhost-scsi: reject feature changes after endpoint
vhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates each command's protection scatterlist array (prot_sgl) according to the acknowledged VIRTIO_SCSI_F_T10_PI bit. The command pools are not rebuilt when VHOST_SET_FEATURES changes that bit later.
Although virtio feature bits must not change after feature negotiation, vhost_scsi_set_features() currently accepts such a request after the endpoint is active and updates acked_features. Enabling T10-PI after endpoint setup therefore leaves prot_sgl NULL while the I/O path follows the new feature bit.
For a 129-page protection payload, vhost_scsi_mapal() passes the missing first chunk to sg_alloc_table_chained():
sg_alloc_table_chained(table, 129, first_chunk=NULL, nents_first_chunk=inline_sg_cnt)
sg_pool_index() then hits:
BUG_ON(nents > SG_CHUNK_SIZE); / 129 > 128 /
The kernel reported the following call trace and register state:
Call Trace: ? __sg_alloc_table+0x1d8/0x250 ? __pfx_vhost_run_work_list+0x10/0x10 [vhost] sg_alloc_table_chained+0x59/0xf0 ? __pfx_sg_pool_alloc+0x10/0x10 ? vhost_scsi_calc_sgls.constprop.0+0x43/0x60 [vhost_scsi] vhost_scsi_handle_vq+0xf02/0x1700 [vhost_scsi] ? __pfx_vhost_scsi_handle_vq+0x10/0x10 [vhost_scsi] vhost_scsi_handle_kick+0x37/0x50 [vhost_scsi] vhost_run_work_list+0x8e/0xd0 [vhost] vhost_task_fn+0xe1/0x210 ret_from_fork+0x348/0x540
RIP: 0010:0x4 CR2 = 0x4 RSP: 0018:ffffc90000dbf940 EFLAGS: 00010202 RAX: ffffffff82396810 RBX: ffff88811dc28b80 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000081
VHOST_F_LOG_ALL is a vhost-specific runtime feature and remains the only exception.
Reject changes to any feature other than VHOST_F_LOG_ALL while the endpoint is active. This preserves the existing runtime log toggle while preventing feature-dependent command resources and data-path state from becoming inconsistent. Userspace must clear the endpoint before changing any other negotiated feature and set the endpoint up again afterward.
{
"affected": [],
"aliases": [
"CVE-2026-74702"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-22T16:16:44Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: reject feature changes after endpoint\n\nvhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates\neach command\u0027s protection scatterlist array (prot_sgl) according to the\nacknowledged VIRTIO_SCSI_F_T10_PI bit. The command pools are not rebuilt\nwhen VHOST_SET_FEATURES changes that bit later.\n\nAlthough virtio feature bits must not change after feature negotiation,\nvhost_scsi_set_features() currently accepts such a request after the\nendpoint is active and updates acked_features. Enabling T10-PI after\nendpoint setup therefore leaves prot_sgl NULL while the I/O path follows\nthe new feature bit.\n\nFor a 129-page protection payload, vhost_scsi_mapal() passes the missing\nfirst chunk to sg_alloc_table_chained():\n\n sg_alloc_table_chained(table, 129, first_chunk=NULL,\n nents_first_chunk=inline_sg_cnt)\n\nsg_pool_index() then hits:\n\n BUG_ON(nents \u003e SG_CHUNK_SIZE); /* 129 \u003e 128 */\n\nThe kernel reported the following call trace and register state:\n\n Call Trace:\n \u003cTASK\u003e\n ? __sg_alloc_table+0x1d8/0x250\n ? __pfx_vhost_run_work_list+0x10/0x10 [vhost]\n sg_alloc_table_chained+0x59/0xf0\n ? __pfx_sg_pool_alloc+0x10/0x10\n ? vhost_scsi_calc_sgls.constprop.0+0x43/0x60 [vhost_scsi]\n vhost_scsi_handle_vq+0xf02/0x1700 [vhost_scsi]\n ? __pfx_vhost_scsi_handle_vq+0x10/0x10 [vhost_scsi]\n vhost_scsi_handle_kick+0x37/0x50 [vhost_scsi]\n vhost_run_work_list+0x8e/0xd0 [vhost]\n vhost_task_fn+0xe1/0x210\n ret_from_fork+0x348/0x540\n \u003c/TASK\u003e\n\n RIP: 0010:0x4\n CR2 = 0x4\n RSP: 0018:ffffc90000dbf940 EFLAGS: 00010202\n RAX: ffffffff82396810 RBX: ffff88811dc28b80 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000081\n\nVHOST_F_LOG_ALL is a vhost-specific runtime feature and remains the only\nexception.\n\nReject changes to any feature other than VHOST_F_LOG_ALL while the\nendpoint is active. This preserves the existing runtime log toggle while\npreventing feature-dependent command resources and data-path state from\nbecoming inconsistent. Userspace must clear the endpoint before changing\nany other negotiated feature and set the endpoint up again afterward.",
"id": "GHSA-r9hq-6x72-7q3j",
"modified": "2026-08-25T06:31:28Z",
"published": "2026-08-22T18:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74702"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/42bc45df5905e2b7dccb72adaf7730f66cfbe03f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9a3eb77a612f9d158e4d27df43677a014e9cfa55"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a06e4611d45518896fbff4f45d9581578b107e91"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.