CVE-2026-74703: vhost-scsi: Validate T10 PI scatterlist counts
In the Linux kernel, the following vulnerability has been resolved:
vhost-scsi: Validate T10 PI scatterlist counts
When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protection bytes that cover or exceed the full payload length. The former leaves no data bytes to map, while the latter underflows expdatalen before advancing the iterator. Both cases can let a zero data SGL count reach sgalloctablechained(), which triggers BUGON(!nents).
Reject protection lengths that cover or exceed the payload before subtracting protbytes and advancing the iterator. Also propagate negative errors from the protection SGL calculation before calling the allocator, matching the data SGL path.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the flaw?
T10 Protection Information must be negotiated for a vhost-scsi request. An attacker must then be able to submit a malformed request whose claimed protection-byte length covers or exceeds the payload length.
What is the likely impact of a successful trigger?
The malformed request can cause a zero data scatter-gather list count to reach sg_alloc_table_chained(), triggering BUG_ON(!nents). This indicates a kernel BUG condition rather than normal request rejection.
Is a vhost-scsi deployment without negotiated T10 PI affected by this request path?
The described vulnerable path is used when T10 PI is negotiated. The provided information does not indicate that requests without negotiated T10 PI reach this condition.
What mitigation is available if the fix cannot be applied immediately?
Avoid negotiating T10 PI for vhost-scsi requests, since negotiation of T10 PI is a stated prerequisite for reaching the vulnerable handling path.