CVE-2025-38074

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vhost-scsi: protect vq->log_used with vq->mutex

The vhost-scsi completion path may access vq->log_base when vq->log_used is

already set to false.

vhost-thread QEMU-thread

vhost_scsi_complete_cmd_work()

-> vhost_add_used()

-> vhost_add_used_n()

if (unlikely(vq->log_used))

QEMU disables vq->log_used

via VHOST_SET_VRING_ADDR.

mutex_lock(&vq->mutex);

vq->log_used = false now!

mutex_unlock(&vq->mutex);

QEMU gfree(vq->log_base)

log_used()

-> log_write(vq->log_base)

Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be

reclaimed via gfree(). As a result, this causes invalid memory writes to

QEMU userspace.

The control queue path has the same issue.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References