CVE-2026-74703 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
vhost-scsi: Validate T10 PI scatterlist counts
When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protection bytes that cover or exceed the full payload length. The former leaves no data bytes to map, while the latter underflows exp_data_len before advancing the iterator. Both cases can let a zero data SGL count reach sg_alloc_table_chained(), which triggers BUG_ON(!nents).
Reject protection lengths that cover or exceed the payload before subtracting prot_bytes and advancing the iterator. Also propagate negative errors from the protection SGL calculation before calling the allocator, matching the data SGL path.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The vhost-scsi subsystem within the Linux kernel contains a critical input validation flaw related to the handling of T10 Protection Information (PI) during scatter-gather list processing. This vulnerability arises from insufficient checks on the relationship between protection metadata and actual payload data lengths when requests are processed by virtualized SCSI targets. Specifically, the code path responsible for splitting protection bytes from the main data iterator fails to adequately validate whether the claimed protection length is reasonable relative to the total payload size. When a guest operating system or malicious user sends a malformed request that claims protection bytes covering or exceeding the full payload length, the kernel logic proceeds to subtract these invalid lengths without first verifying their validity against established bounds.
This lack of validation leads directly to integer underflow conditions in the exp_data_len variable as the iterator advances through the scatter-gather list entries. In scenarios where the protection data covers the entire payload, no actual data bytes remain to be mapped for I/O operations. Consequently, a zero count is passed to sg_alloc_table_chained(), which expects at least one valid entry. The kernel subsequently triggers a BUG_ON assertion failure because nents equals zero, resulting in an immediate and unhandled system crash or panic. This represents a severe availability impact, allowing any user with access to the vhost-scsi device node to cause a denial of service against the host machine by simply submitting crafted SCSI commands that exploit this boundary condition.
From a vulnerability classification perspective, this issue aligns closely with CWE-20 Improper Input Validation and CWE-190 Integer Overflow or Wraparound. The failure occurs because the system does not properly sanitize user-supplied data before using it in arithmetic operations that determine memory allocation sizes and iterator positions. Furthermore, the exploitation vector relates to ATT&CK technique T1499 Endpoint Denial of Service, as the primary outcome is the disruption of service through kernel panic rather than arbitrary code execution or privilege escalation. The root cause lies in the assumption that incoming SCSI requests will always adhere to standard protocol constraints regarding protection information lengths, an assumption that cannot be trusted when dealing with potentially hostile virtualization environments.
To mitigate this vulnerability, it is imperative to apply the upstream Linux kernel patches that enforce strict validation of T10 PI scatterlist counts before any arithmetic operations are performed on data length variables. The fix involves rejecting protection lengths that cover or exceed the payload size prior to subtracting prot_bytes and advancing iterators. Additionally, error propagation mechanisms must be updated to handle negative errors from protection SGL calculations consistently with how they are handled in the data SGL path. System administrators should ensure their kernels are updated to versions containing these fixes. For environments where immediate patching is not feasible, restricting access to vhost-scsi devices and implementing strict network-level filtering for SCSI traffic can provide partial mitigation by reducing the attack surface available to potential adversaries attempting to trigger this condition.