UBUNTU-CVE-2026-74703: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protection bytes that cover or exceed the full payload length. The former leaves no data bytes to map, while the latter underflows expdatalen before advancing the iterator. Both cases can let a zero data SGL count reach sgalloctablechained(), which triggers BUGON(!nents). Reject protection lengths that cover or exceed the payload before subtracting protbytes and advancing the iterator. Also propagate negative errors from the protection SGL calculation before calling the allocator, matching the data SGL path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
When T10 PI is negotiated, reject requests whose protection bytes cover or exceed the full payload before subtracting prot_bytes and advancing the data iterator.
Linux kernel vhost-scsi T10 PI protection-length validation = reject protection lengths that cover or exceed the payload length - Configuration
Propagate negative errors from the protection SGL calculation before calling the allocator, matching the data SGL path, and prevent a zero data SGL count from reaching sg_alloc_table_chained().
Linux kernel vhost-scsi protection SGL calculation error handling = propagate negative errors before allocation