CVE-2026-74703

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the vhost-scsi component when T10 PI (Protection Information) is negotiated. The system splits protection bytes from the data iterator before mapping request scatterlists. A malformed request can specify protection bytes that cover or exceed the full payload length, which can lead to an underflow of the exp data len variable or leave no data bytes to map. This allows a zero data SGL (Scatter Gather List) count to reach the sg alloc table chained() function, triggering a system crash via BUG ON(!nents).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.