CVE-2025-22083

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint

If vhost_scsi_set_endpoint is called multiple times without a

vhost_scsi_clear_endpoint between them, we can hit multiple bugs

found by Haoran Zhang:

1. Use-after-free when no tpgs are found:

This fixes a use after free that occurs when vhost_scsi_set_endpoint is

called more than once and calls after the first call do not find any

tpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds

tpgs to add to the vs_tpg array match=true, so we will do:

vhost_vq_set_backend(vq, vs_tpg);

...

kfree(vs->vs_tpg);

vs->vs_tpg = vs_tpg;

If vhost_scsi_set_endpoint is called again and no tpgs are found

match=false so we skip the vhost_vq_set_backend call leaving the

pointer to the vs_tpg we then free via:

kfree(vs->vs_tpg);

vs->vs_tpg = vs_tpg;

If a scsi request is then sent we do:

vhost_scsi_handle_vq -> vhost_scsi_get_req -> vhost_vq_get_backend

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References