Bug 2521398 (CVE-2026-74703)

Summary:	CVE-2026-74703 kernel: vhost-scsi: Validate T10 PI scatterlist counts
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's `vhost-scsi` component. When T10 Protection Information (PI) is negotiated, a remote attacker could send a specially crafted request with malformed scatterlist counts. This could lead to an invalid memory allocation operation, triggering a kernel panic and resulting in a Denial of Service (DoS) for the affected system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-22 15:43:35 UTC

In the Linux kernel, the following vulnerability has been resolved:

vhost-scsi: Validate T10 PI scatterlist counts

When T10 PI is negotiated, vhost-scsi splits protection bytes from
the data iterator before mapping the request scatterlists. A malformed
request can claim protection bytes that cover or exceed the full payload
length. The former leaves no data bytes to map, while the latter
underflows exp_data_len before advancing the iterator. Both cases can let
a zero data SGL count reach sg_alloc_table_chained(), which triggers
BUG_ON(!nents).

Reject protection lengths that cover or exceed the payload before
subtracting prot_bytes and advancing the iterator. Also propagate
negative errors from the protection SGL calculation before calling the
allocator, matching the data SGL path.

Comment 1 Mauro Matteo Cascella 2026-08-24 10:57:32 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026082236-CVE-2026-74703-dcf0@gregkh/T