The vulnerability in the Linux kernel vhost-scsi driver involves improper validation of T10 PI scatterlist counts when T10 PI is negotiated. Specifically, malformed requests could claim protection bytes that cover or exceed the full payload length, resulting in either no data bytes to map or an underflow in the expected data length before advancing the iterator. Both conditions allow a zero data scatter-gather list count to reach sg_alloc_table_chained(), triggering a BUG_ON(!nents) kernel panic. The patch corrects this by rejecting protection lengths that cover or exceed the payload before subtracting protection bytes and advancing the iterator, and by propagating negative errors from protection scatterlist calculations before calling the allocator, aligning with the data scatter-gather list path.

Exploitation of this vulnerability can cause a kernel panic (BUG_ON) in the Linux kernel's vhost-scsi driver, leading to denial of service conditions. There is no indication of code execution or privilege escalation from the provided information. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch to resolve the issue. Since this is a kernel-level bug causing a panic, updating to a patched kernel version is the recommended mitigation. No additional mitigations or workarounds are indicated.