CVE-2026-99155: scsi: xen/scsifront: Check for a NULL shadow entry on a backend response

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

scsi: xen/scsifront: Check for a NULL shadow entry on a backend response

scsifrontdoresponse() validates the rqid in a backend response against VSCSIIFMAXREQS before using it to index info->shadow[], but then dereferences the entry to test ->inflight without checking that the slot is populated. Shadow slots are NULL before a command is submitted (the host private area is zeroed at allocation) and are reset to NULL in scsifrontputrqid() once a request completes, so an in-range rqid that does not correspond to an outstanding request makes the frontend dereference a NULL pointer.

A malicious or buggy backend can thus crash the guest by returning a response whose rqid is in range but not in flight -- for example a spurious response before any command has been issued, or a duplicate of one already completed. The ring has only VSCSIIFMAXREQS (16) slots, so before the first command every in-range rqid selects a NULL slot.

Reject a response whose shadow slot is not populated.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 28, 2026

CVE Published

via MITRE·10:35 AM

Data Sourced

via MITRE·10:35 AM

Description

Data Sourced

via NVD·11:17 AM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

Linux guests using the Xen SCSI frontend are exposed when their SCSI backend can return malformed, unexpected, or duplicate responses. The issue is triggered by an in-range request ID that does not correspond to an outstanding command.

What does an attacker or faulty component need to do to trigger the crash?

The backend must send a response with an rqid within the valid ring range but whose shadow entry is NULL or no longer in flight. This can occur with a spurious response before the guest has issued any command, or by duplicating a response for a request that has already completed.

What is the impact on the guest?

The frontend can dereference a NULL shadow entry and crash the guest. The described impact is denial of service.

How can I determine whether a response is unsafe?

A response is unsafe when its rqid is in range but the corresponding frontend shadow slot is not populated. Before the first command is submitted, every in-range rqid selects a NULL slot; completed requests also have their shadow slots reset to NULL.

What mitigation is described if the backend cannot immediately be trusted or updated?

The described fix is to reject backend responses whose shadow slot is not populated. This prevents the NULL dereference for responses that do not correspond to an outstanding request.

CVE-2026-99155: scsi: xen/scsifront: Check for a NULL shadow entry on a backend response

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker or faulty component need to do to trigger the crash?

What is the impact on the guest?

How can I determine whether a response is unsafe?

What mitigation is described if the backend cannot immediately be trusted or updated?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker or faulty component need to do to trigger the crash?

What is the impact on the guest?

How can I determine whether a response is unsafe?

What mitigation is described if the backend cannot immediately be trusted or updated?