Linux kernel vhost-scsi: malformed guest request with T10 protection bytes panics the host

Impact

With T10 protection information negotiated, vhost-scsi splits protection bytes off the data iterator before mapping scatterlists. A guest can claim a protection length that covers or exceeds the whole payload, which either leaves no data bytes to map or underflows exp_data_len, and a zero-entry data SGL then reaches sg_alloc_table_chained() and trips BUG_ON(!nents). The record establishes a host kernel panic from inside a guest, not privilege escalation. On a virtualized GPU host that is the entire node: every passthrough or vGPU tenant on the box goes down with it, and any collective job with a rank pinned there restarts from the last checkpoint.

Who can reach it

Any guest able to submit virtio-scsi requests to a vhost-scsi backed disk with T10 PI negotiated. No host credentials are needed - being a tenant VM on the node is enough. Hosts that do not use vhost-scsi are not exposed.

What to do

Take a stable kernel carrying the fix and reboot; the vhost-scsi path is in the running kernel, so there is no live patch short of a full node drain and reboot. Until then, exposure is bounded by whether guests are given vhost-scsi disks with protection information enabled - disabling T10 PI on those devices removes the path the record describes. Batch this with other pending kernel fixes, since the drain cost is the same for one as for five.

References

Related entries

• Linux kernel mlx5 vDPA: memory-region key creation reads past the firmware command bufferCVE-2026-74712 · Linux kernel mlx5_vdpa (create_direct_keys input buffer length)Unscored
• Linux kernel BPF TCP iterator: stolen reference on a half-published request socket ends in use-after-freeCVE-2026-74714 · Linux kernel BPF TCP iterator (bpf_iter_tcp_established_batch refcount)Unscored
• Linux kernel BPF conntrack kfuncs: racing opts update unbalances the netns reference countCVE-2026-74715 · Linux kernel BPF conntrack kfuncs (opts->netns_id get/put pairing)Unscored
• Linux kernel SMC-R: duplicate LLC link messages from a peer leak one kmalloc-96 object eachCVE-2026-74719 · Linux kernel SMC-R LLC event handler (duplicate CONFIRM_LINK / ADD_LINK_CONT qentry)Unscored
• Linux kernel BPF verifier: commuted pointer arithmetic loses pointer provenance stateCVE-2026-74720 · Linux kernel BPF verifier (adjust_ptr_min_max_vals, scalar += pointer)Unscored
• Linux kernel sched_ext: a failed sub-scheduler enable races root disable into a use-after-freeCVE-2026-74731 · Linux kernel sched_ext (scx_sub_disable teardown of never-linked sub-schedulers)Unscored