Linux kernel vhost-scsi: repeated SET_ENDPOINT calls cause use-after-free, refcount underflow and TPG leaks

CVSS 7.8CVE-2025-22083Kernel, userspace & hypervisorcurated

Impact

Calling VHOST_SCSI_SET_ENDPOINT more than once without clearing the endpoint in between caused three bugs. If the later call finds no target portal groups, the pointer array is freed and then used: a use-after-free on the next SCSI request from the guest. The refcount on a LIO target portal group can drop to -1, which hangs userspace when it tries to remove the TPG directory. TPGs also leak when the endpoint is re-set to a different target name. This affects hypervisor hosts that back guest disks with vhost-scsi. The record notes that QEMU already refuses repeated set-endpoint calls, so a standard QEMU stack does not trigger it.

Who can reach it

Local on the host. Requires a process that can open /dev/vhost-scsi and issue the ioctl, which in practice means the VMM or root. It is not reachable from inside a guest according to the record.

What to do

Update to a stable kernel with the fix (commits in the record) and reboot the hypervisor hosts. Live-migrate guests off each host first. Hosts that run only stock QEMU are protected by QEMU's own check, which lowers the urgency.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-22083 https://git.kernel.org/stable/c/2b34bdc42df047794542f3e220fe989124e4499a https://git.kernel.org/stable/c/3a19eb3d9818e28f14c818a18dc913344a52ca92

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.