In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhost_scsi_setup_vq_cmds()… (CVE-2026-74702)
A vulnerability in the Linux kernel's vhost-scsi component allowed changes to virtio feature bits after endpoint setup, leading to inconsistent command resource allocation and a kernel BUG. Specifically, enabling the T10-PI feature after endpoint setup caused a NULL pointer dereference in scatterlist allocation, resulting in a kernel crash. The issue is fixed by rejecting feature changes after the endpoint is active, except for the VHOST_F_LOG_ALL feature.
AI Analysis
Technical Summary
The Linux kernel vhost-scsi driver improperly allowed changes to virtio feature bits after the endpoint was set up. The function vhost_scsi_setup_vq_cmds() allocates protection scatterlist arrays based on the acknowledged VIRTIO_SCSI_F_T10_PI bit. If this feature bit changes after setup, the command pools are not rebuilt accordingly, causing prot_sgl to remain NULL. This leads to a BUG_ON condition in sg_pool_index() when handling large protection payloads (e.g., 129 pages), causing a kernel crash. The fix enforces rejection of feature changes after endpoint activation except for the runtime log toggle feature VHOST_F_LOG_ALL. Userspace must clear and reset the endpoint to change features safely.
Potential Impact
This vulnerability can cause a kernel crash (BUG) due to a NULL pointer dereference in the vhost-scsi driver when feature bits are changed after endpoint setup. This may lead to denial of service on affected systems running the vulnerable Linux kernel versions. No information about privilege escalation or data corruption is provided.
Mitigation Recommendations
A fix is available that rejects any feature changes after the vhost-scsi endpoint is active, except for the VHOST_F_LOG_ALL feature. Userspace must clear the endpoint before changing any other negotiated features and then set the endpoint up again. Apply the official kernel patch that enforces this behavior to prevent the issue.
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhost_scsi_setup_vq_cmds()… (CVE-2026-74702)
Description
A vulnerability in the Linux kernel's vhost-scsi component allowed changes to virtio feature bits after endpoint setup, leading to inconsistent command resource allocation and a kernel BUG. Specifically, enabling the T10-PI feature after endpoint setup caused a NULL pointer dereference in scatterlist allocation, resulting in a kernel crash. The issue is fixed by rejecting feature changes after the endpoint is active, except for the VHOST_F_LOG_ALL feature.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vhost-scsi driver improperly allowed changes to virtio feature bits after the endpoint was set up. The function vhost_scsi_setup_vq_cmds() allocates protection scatterlist arrays based on the acknowledged VIRTIO_SCSI_F_T10_PI bit. If this feature bit changes after setup, the command pools are not rebuilt accordingly, causing prot_sgl to remain NULL. This leads to a BUG_ON condition in sg_pool_index() when handling large protection payloads (e.g., 129 pages), causing a kernel crash. The fix enforces rejection of feature changes after endpoint activation except for the runtime log toggle feature VHOST_F_LOG_ALL. Userspace must clear and reset the endpoint to change features safely.
Potential Impact
This vulnerability can cause a kernel crash (BUG) due to a NULL pointer dereference in the vhost-scsi driver when feature bits are changed after endpoint setup. This may lead to denial of service on affected systems running the vulnerable Linux kernel versions. No information about privilege escalation or data corruption is provided.
Mitigation Recommendations
A fix is available that rejects any feature changes after the vhost-scsi endpoint is active, except for the VHOST_F_LOG_ALL feature. Userspace must clear the endpoint before changing any other negotiated features and then set the endpoint up again. Apply the official kernel patch that enforces this behavior to prevent the issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-r9hq-6x72-7q3j
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-74702"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a8a27f0acd9273b499bc73c
Added to database: 08/22/2026, 22:51:28 UTC
Last enriched: 08/23/2026, 00:38:33 UTC
Last updated: 08/23/2026, 02:12:03 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.