Linux vhost-scsi: stale response iovecs after a memory-table change write into unrelated memory

Impact

vhost-scsi translates guest response descriptors into host userspace iovecs at submission time, but target-core completes asynchronously. VHOST_SET_MEM_TABLE can swap the memory table while a command still holds iovecs translated through the old one, so the completion writes the SCSI response into an unrelated userspace object in the VMM process. The CVSS vector records a scope change - this crosses the VM boundary into the hypervisor process, which is exactly the boundary a GPU cloud sells. On nodes that pass GPUs into KVM guests with vhost-scsi storage, a guest that can drive the ioctl sequence gets a write into host VMM memory.

Who can reach it

Local - whoever controls the vhost-scsi device file and the ioctl sequence, i.e. the VMM process serving a guest, or a guest able to influence it. High attack complexity: the race between an in-flight command and the memory-table update has to be won. Only hosts using vhost-scsi are affected.

What to do

Install a kernel with the vhost-scsi backend-flush fix and reboot the hypervisor hosts; live migration of guests off the node first keeps the cost to a rolling drain. Hosts that do not use vhost-scsi storage for guests can defer.

References

Related entries

• Linux kernel perf: addr_filter_ranges freed without RCU grace period, leaving a use-after-freeCVE-2026-93817 · Linux kernel perf events (event::addr_filter_ranges RCU lifetime)High
• sudo: TZ from the calling user shifts NOTBEFORE/NOTAFTER windows, reviving expired rulesCVE-2026-96512 · sudo (NOTBEFORE/NOTAFTER sudoers time restrictions)High
• Linux slab allocator: ABA race in the optimistic freelist return corrupts the partial listCVE-2026-97941 · Linux kernel mm/slab (__slab_try_return_freelist ABA race)High
• Linux AMD IOMMU: sign-discarding error check lets nested domains use an unallocated domain IDCVE-2026-98002 · Linux kernel iommu/amd (amd_iommu_alloc_domain_nested error check)High
• Linux kernel BPF: per-CPU map updates index by logical CPU id, reading past the update bufferCVE-2026-98149 · Linux kernel BPF per-CPU map update paths (array, hash, cgroup storage)High
• Linux kernel RDMA/rxe: ODP write paths accept read-only pages, letting RDMA traffic overwrite the page cacheCVE-2026-98361 · Linux kernel RDMA/rxe (soft-RoCE on-demand paging write path)High