CVE-2026-74702

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vhost-scsi: reject feature changes after endpoint

vhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates

each command's protection scatterlist array (prot_sgl) according to the

acknowledged VIRTIO_SCSI_F_T10_PI bit. The command pools are not rebuilt

when VHOST_SET_FEATURES changes that bit later.

Although virtio feature bits must not change after feature negotiation,

vhost_scsi_set_features() currently accepts such a request after the

endpoint is active and updates acked_features. Enabling T10-PI after

endpoint setup therefore leaves prot_sgl NULL while the I/O path follows

the new feature bit.

For a 129-page protection payload, vhost_scsi_mapal() passes the missing

first chunk to sg_alloc_table_chained():

sg_alloc_table_chained(table, 129, first_chunk=NULL,

nents_first_chunk=inline_sg_cnt)

sg_pool_index() then hits:

BUG_ON(nents > SG_CHUNK_SIZE); /* 129 > 128

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References