Description

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOST_SET_MEM_TABLE can replace the memory table while an in-flight command still retains response iovecs translated through the old table. If the old mapping is reused after VHOST_SET_MEM_TABLE returns, command completion can write the response to an unrelated userspace object. Flush the vhost-scsi backend after vhost_dev_ioctl() handles a device ioctl. This waits for in-flight commands that can still use the old response iovecs before the ioctl returns.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-24T17:17:10.793Z",
  "pubdate": "2026-09-24T17:17:10.793Z",
  "executiveSummary": "The vhost-scsi component in the Linux kernel is susceptible to a use-after-free vulnerability stemming from improper synchronization during memory table updates.\nThe flaw exists because vhost-scsi fails to adequately flush in-flight I/O commands when VHOST_SET_MEM_TABLE ioctls are invoked, allowing these commands to reference stale memory mappings.\nThis vulnerability permits an attacker to potentially corrupt memory in the userspace context or execute arbitrary code if the memory is repurposed for sensitive structures.\nImpact includes memory corruption, system instability, or privilege escalation within the host environment.\nExploitation requires an attacker to have the ability to interact with the vhost-scsi interface, typically requiring access to the device file associated with the virtio-scsi backend.\nThe vulnerability is limited to the kernel-space handling of virtio-scsi command responses and represents a high-risk security flaw for virtualized environments utilizing the vhost-scsi backend.",
  "technicalDetails": "The root cause of this vulnerability lies in the race condition between asynchronous I/O completion and the modification of the vhost memory table (VHOST_SET_MEM_TABLE).\nIn vhost-scsi, guest response descriptors are translated into userspace iovecs at the time of command submission. These iovecs rely on the memory mapping provided by the current vhost memory table.\nThe target-core subsystem handles these commands asynchronously. Consequently, a race condition occurs when a VHOST_SET_MEM_TABLE ioctl is executed while commands are still pending in the target-core layer. The VHOST_SET_MEM_TABLE operation updates the memory translation table, effectively invalidating the mappings previously used to resolve the iovecs for pending commands.\nBecause vhost-scsi does not flush the backend after device ioctls, the in-flight commands remain active in the target-core layer. When these commands complete, they attempt to write responses back to the original iovecs. Since the memory table has been updated, these iovecs may now resolve to different physical memory addresses than intended, leading to an out-of-bounds write or a write to an unrelated userspace object.\nExploitation involves the following sequence: 1) The attacker initiates I/O requests through the vhost-scsi interface; 2) The attacker triggers a VHOST_SET_MEM_TABLE ioctl, which changes the memory mapping while the initial requests are still being processed by target-core; 3) The target-core component completes the original requests, utilizing the stale, now-invalidated iovec address translations; 4) The kernel performs a write operation to memory that is either unmapped or, more dangerously, re-allocated to a different userspace component.\nThis behavior results in a use-after-free scenario where the response buffer is essentially 'freed' from its previous context by the memory table update but still written to by the asynchronous backend. The post-exploitation impact is contingent on the nature of the memory at the target address; if an attacker can manipulate the userspace memory layout, they may achieve arbitrary write primitives leading to kernel-to-user privilege escalation."
}