CVE-2026-74703vhost-scsi: Validate T10 PI scatterlist counts
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protection bytes that cover or exceed the full payload length. The former leaves no data bytes to map, while the latter underflows exp_data_len before advancing the iterator. Both cases can let a zero data SGL count reach sg_alloc_table_chained(), which triggers BUG_ON(!nents). Reject protection lengths that cover or exceed the payload before subtracting prot_bytes and advancing the iterator. Also propagate negative errors from the protection SGL calculation before calling the allocator, matching the data SGL path.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from bca939d5bcd00d6faea99c47eafd60bed573ef03 before 2417a498cf3fe64d06faf87e236eda98dd4f04e0; from bca939d5bcd00d6faea99c47eafd60bed573ef03 before f8fe3f8d342da750dd10361bf66009fd3072926b; from bca939d5bcd00d6faea99c47eafd60bed573ef03 before d876c493fc4b811941bfeb4c80beb2dfc4bf025e | CNA record |
References
- https://git.kernel.org/stable/c/2417a498cf3fe64d06faf87e236eda98dd4f04e0
- https://git.kernel.org/stable/c/f8fe3f8d342da750dd10361bf66009fd3072926b
- https://git.kernel.org/stable/c/d876c493fc4b811941bfeb4c80beb2dfc4bf025e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.