CVE-2025-38074

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been identified, specifically in the vhost-scsi completion path. The issue arises when the vhost-scsi completion path accesses vq->log base while vq->log used is already set to false. This can lead to invalid memory writes to QEMU userspace, as the vq->log base is reclaimed via gfree(). The control queue path is also affected by this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.