CVE-2026-74703: vhost-scsi: Validate T10 PI scatterlist counts

Published Aug 22, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

vhost-scsi: Validate T10 PI scatterlist counts

When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protection bytes that cover or exceed the full payload length. The former leaves no data bytes to map, while the latter underflows expdatalen before advancing the iterator. Both cases can let a zero data SGL count reach sgalloctablechained(), which triggers BUGON(!nents).

Reject protection lengths that cover or exceed the payload before subtracting protbytes and advancing the iterator. Also propagate negative errors from the protection SGL calculation before calling the allocator, matching the data SGL path.

Affected Software

1 affected component
Linux Linux kernel

Event History

Aug 22, 2026
CVE Published
via MITRE·03:33 PM
Data Sourced
via MITRE·03:33 PM
Description
Data Sourced
via NVD·04:16 PM
Description

Frequently Asked Questions

1

What conditions are required to trigger the flaw?

T10 Protection Information must be negotiated for a vhost-scsi request. An attacker must then be able to submit a malformed request whose claimed protection-byte length covers or exceeds the payload length.

2

What is the likely impact of a successful trigger?

The malformed request can cause a zero data scatter-gather list count to reach sg_alloc_table_chained(), triggering BUG_ON(!nents). This indicates a kernel BUG condition rather than normal request rejection.

3

Is a vhost-scsi deployment without negotiated T10 PI affected by this request path?

The described vulnerable path is used when T10 PI is negotiated. The provided information does not indicate that requests without negotiated T10 PI reach this condition.

4

What mitigation is available if the fix cannot be applied immediately?

Avoid negotiating T10 PI for vhost-scsi requests, since negotiation of T10 PI is a stated prerequisite for reaching the vulnerable handling path.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203