CVE-2026-74703
Received Received - Intake

Vhost-scsi T10 PI Validation Flaw in Linux Kernel

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protection bytes that cover or exceed the full payload length. The former leaves no data bytes to map, while the latter underflows exp_data_len before advancing the iterator. Both cases can let a zero data SGL count reach sg_alloc_table_chained(), which triggers BUG_ON(!nents). Reject protection lengths that cover or exceed the payload before subtracting prot_bytes and advancing the iterator. Also propagate negative errors from the protection SGL calculation before calling the allocator, matching the data SGL path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74703
EUVD
EUVD-2026-64390

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves vhost-scsi incorrectly handling T10 Protection Information (PI) requests. When PI is enabled, the system splits protection bytes from data. A malformed request can claim protection bytes covering or exceeding the full payload length, leading to zero data scatterlist (SGL) counts. This causes a kernel bug check (BUG_ON) when sg_alloc_table_chained() is called with invalid parameters.

Detection Guidance

This vulnerability is specific to the Linux kernel's vhost-scsi driver and requires kernel-level inspection. Detection involves checking kernel logs for BUG_ON errors related to sg_alloc_table_chained or vhost-scsi operations. Monitor dmesg for crashes or warnings during SCSI operations with T10 PI enabled.

Impact Analysis

This flaw could cause a kernel panic or system crash if exploited via a malicious request. It affects systems using vhost-scsi with T10 PI enabled, potentially disrupting services relying on virtualized storage. Unpatched systems may experience unexpected downtime or data corruption.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vhost-scsi T10 PI validation issue. Disable vhost-scsi if T10 PI is not required, or restrict access to untrusted users. Monitor vendor advisories for kernel updates addressing this CVE.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74703. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart