CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex
In the Linux kernel, the following vulnerability has been resolved:
vhost-scsi: protect vq->logused with vq->mutex
The vhost-scsi completion path may access vq->logbase when vq->logused is already set to false.
vhost-thread QEMU-thread
vhostscsicompletecmdwork() -> vhostaddused() -> vhostaddusedn() if (unlikely(vq->logused)) QEMU disables vq->logused via VHOSTSETVRINGADDR. mutexlock(&vq->mutex); vq->logused = false now! mutexunlock(&vq->mutex);
QEMU gfree(vq->logbase) logused() -> logwrite(vq->logbase)
Assuming the VMM is QEMU. The vq->logbase is from QEMU userpace and can be reclaimed via gfree(). As a result, this causes invalid memory writes to QEMU userspace.
The control queue path has the same issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Protect vq->log_used and accesses to vq->log_base in the vhost-scsi completion and control queue paths with vq->mutex, preventing access after QEMU disables vq->log_used and reclaims vq->log_base via gfree().
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38074?
CVE-2025-38074 has been assessed with a medium severity level due to its potential to lead to information disclosure.
How do I fix CVE-2025-38074?
To fix CVE-2025-38074, users should update the Linux kernel and QEMU to the latest secure versions that include the necessary patches.
What software is affected by CVE-2025-38074?
CVE-2025-38074 affects the Linux kernel and QEMU implementations that utilize vhost-scsi.
What are the consequences of CVE-2025-38074?
Exploitation of CVE-2025-38074 could lead to unreliable behavior in the vhost-scsi subsystem, potentially affecting data integrity.
Is CVE-2025-38074 publicly known?
Yes, CVE-2025-38074 is a publicly disclosed vulnerability, making it imperative for users to address it promptly.