In the Linux kernel, the following vulnerability has been resolved:

vhost-scsi: flush backend after device ioctls

vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOST SET MEM TABLE can replace the memory table while an in-flight command still retains response iovecs translated through the old table.

If the old mapping is reused after VHOST SET MEM TABLE returns, command completion can write the response to an unrelated userspace object.

Flush the vhost-scsi backend after vhost dev ioctl() handles a device ioctl. This waits for in-flight commands that can still use the old response iovecs before the ioctl returns.