CVE-2026-93782: vhost-scsi: flush backend after device ioctls
In the Linux kernel, the following vulnerability has been resolved:
vhost-scsi: flush backend after device ioctls
vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOSTSETMEMTABLE can replace the memory table while an in-flight command still retains response iovecs translated through the old table.
If the old mapping is reused after VHOSTSETMEMTABLE returns, command completion can write the response to an unrelated userspace object.
Flush the vhost-scsi backend after vhostdevioctl() handles a device ioctl. This waits for in-flight commands that can still use the old response iovecs before the ioctl returns.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Flush the vhost-scsi backend after vhost_dev_ioctl() handles a device, ensuring target-core completes in-flight commands before VHOST_SET_MEM_TABLE replaces the memory table.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel vhost-scsi backend are exposed when device ioctls can replace the vhost memory table while vhost-scsi commands are still in flight.
What must occur for the unsafe write to happen?
An in-flight command must retain response iovecs translated using the old memory table, and VHOST_SET_MEM_TABLE must replace that table. The old mapping must then be reused before asynchronous target-core command completion writes the response.
How can this be mitigated if the fix cannot be applied immediately?
Avoid changing the vhost memory table with VHOST_SET_MEM_TABLE while vhost-scsi commands may still be in flight. Ensure outstanding commands have completed before allowing the old mapping to be reused.