CVE-2026-74702

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the vhost-scsi component where the vhost scsi set features() function allows changes to feature bits after an endpoint is active. Specifically, if the VIRTIO SCSI F T10 PI bit is enabled after endpoint setup, the prot sgl (protection scatterlist array) remains NULL. This inconsistency between the acknowledged features and the allocated command resources can lead to a kernel crash. For instance, when vhost scsi mapal() processes a protection payload exceeding 128 pages, it calls sg alloc table chained() with a NULL first chunk, eventually triggering a BUG ON condition in sg pool index() because the number of entries exceeds SG CHUNK SIZE.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.