CVE-2026-93782

Received Received - Intake

vhost-scsi Memory Corruption in Linux Kernel

Publication date: 2026-09-24

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOST_SET_MEM_TABLE can replace the memory table while an in-flight command still retains response iovecs translated through the old table. If the old mapping is reused after VHOST_SET_MEM_TABLE returns, command completion can write the response to an unrelated userspace object. Flush the vhost-scsi backend after vhost_dev_ioctl() handles a device ioctl. This waits for in-flight commands that can still use the old response iovecs before the ioctl returns.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-13

NVD

CVE-2026-93782

EUVD

EUVD-2026-86169

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	vhost_scsi	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves vhost-scsi, a component that translates guest response descriptors into userspace iovecs for command submissions. The issue occurs when VHOST_SET_MEM_TABLE replaces the memory table while an in-flight command still uses the old response iovecs. This can lead to command completion writing responses to unrelated userspace objects if the old mapping is reused after the ioctl returns.

Detection Guidance

This vulnerability is specific to the Linux kernel's vhost-scsi component and may not have direct detection commands. Monitor kernel logs for vhost-scsi related errors or crashes after ioctl operations. Check for unusual memory access patterns or crashes in userspace applications using vhost-scsi.

Impact Analysis

This vulnerability could allow unauthorized memory access or corruption in userspace objects, potentially leading to data leaks, crashes, or privilege escalation. Systems using vhost-scsi with virtualization may experience instability or security breaches if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to memory mapping and command completion in the Linux kernel's vhost-scsi subsystem. Compliance impacts would depend on specific implementations and whether unauthorized memory access occurs.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, restrict access to vhost-scsi functionality or disable it if not required. Monitor vendor advisories for kernel updates addressing this issue.

Hi! I’m here to help you understand CVE-2026-93782. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70