CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex
In the Linux kernel, the following vulnerability has been resolved:
vhost-scsi: protect vq->logused with vq->mutex
The vhost-scsi completion path may access vq->logbase when vq->logused is already set to false.
vhost-thread QEMU-thread
vhostscsicompletecmdwork() -> vhostaddused() -> vhostaddusedn() if (unlikely(vq->logused)) QEMU disables vq->logused via VHOSTSETVRINGADDR. mutexlock(&vq->mutex); vq->logused = false now! mutexunlock(&vq->mutex);
QEMU gfree(vq->logbase) logused() -> logwrite(vq->logbase)
Assuming the VMM is QEMU. The vq->logbase is from QEMU userpace and can be reclaimed via gfree(). As a result, this causes invalid memory writes to QEMU userspace.
The control queue path has the same issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement the change: vhost-scsi: protect vq->log_used with vq->mutex, so vhost_scsi_complete_cmd_work can safely access vq->log_base when vq->log_used might be reclaimed.
vhost-scsi (vhost-scsi completion path) Protect vq->log_used with vq->mutex = mutex lock around checks/uses
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38074?
CVE-2025-38074 has been assessed with a medium severity level due to its potential to lead to information disclosure.
How do I fix CVE-2025-38074?
To fix CVE-2025-38074, users should update the Linux kernel and QEMU to the latest secure versions that include the necessary patches.
What software is affected by CVE-2025-38074?
CVE-2025-38074 affects the Linux kernel and QEMU implementations that utilize vhost-scsi.
What are the consequences of CVE-2025-38074?
Exploitation of CVE-2025-38074 could lead to unreliable behavior in the vhost-scsi subsystem, potentially affecting data integrity.
Is CVE-2025-38074 publicly known?
Yes, CVE-2025-38074 is a publicly disclosed vulnerability, making it imperative for users to address it promptly.