Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiated,… (CVE-2026-74703)

The Linux kernel's vhost-scsi driver mishandled T10 PI scatterlist counts when T10 PI was negotiated. Specifically, it split protection bytes from the data iterator before mapping request scatterlists. Malformed requests could claim protection bytes covering or exceeding the entire payload length, resulting in zero data scatter-gather list (SGL) counts reaching sg_alloc_table_chained(), which triggers a BUG_ON(!nents) kernel assertion failure. The fix involves rejecting protection lengths that cover or exceed the payload before subtracting protection bytes and advancing the iterator, and propagating negative errors from protection SGL calculations before calling the allocator, aligning with the data SGL path.

This vulnerability can cause a denial of service by triggering kernel BUG_ON assertions, leading to kernel crashes. There is no indication of confidentiality or integrity impact. The CVSS score is 7.1 (medium severity) with an attack vector of local access and no privileges required, emphasizing the potential for local denial of service.

The vulnerability has been resolved in the Linux kernel. Users should apply the official kernel updates that include the fix for this issue. Since no vendor advisory or patch links are provided, verify with the Linux kernel or distribution vendor for the appropriate patched kernel version. Patch status is not yet confirmed in the provided data — check the vendor advisory for current remediation guidance.