vhost-scsi: flush backend after device ioctls (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.12 % · centile 2 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Received
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOST_SET_MEM_TABLE can replace the memory table while an in-flight command still retains response iovecs translated through the old table. If the old mapping is reused after VHOST_SET_MEM_TABLE returns, command completion can write the response to an unrelated userspace object. Flush the vhost-scsi backend after vhost_dev_ioctl() handles a device ioctl. This waits for in-flight commands that can still use the old response iovecs before the ioctl returns.
Références
- https://git.kernel.org/stable/c/6436411203d8c702ffc055700f1a6bde488ff681
- https://git.kernel.org/stable/c/cec088285adcc7ae23c119b6bbdb22270dc2de8f
- https://git.kernel.org/stable/c/e0bf6bed528693a6b32439ab122b34a34b66d96f
- https://git.kernel.org/stable/c/be2636e1b21fe860db918152abf2932638d06ed7
- https://git.kernel.org/stable/c/981c97d09c6b9560bb12dcc41f11ce59b1a48e97
- https://git.kernel.org/stable/c/6c1b802e36b05ebd9d41686c4dce6f06966af469
- https://git.kernel.org/stable/c/22598f55a4c2b510b3df5e69e563387a963222ae
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-86169
- GCVE · GCVE-0-2026-93782
Avis du CERT-FR
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1372 — Multiples vulnérabilités dans les produits SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1335 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1289 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1253 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 057cbf49a1f08297877e46c82f707b1bfea806a8 < 6436411203d8c702ffc055700f1a6bde488ff681 ; affected 057cbf49a1f08297877e46c82f707b1bfea806a8 < cec088285adcc7ae23c119b6bbdb22270dc2de8f ; affected 057cbf49a1f08297877e46c82f707b1bfea806a8 < e0bf6bed528693a6b32439ab122b34a34b66d96f ; affected 057cbf49a1f08297877e46c82f707b1bfea806a8 < be2636e1b21fe860db918152abf2932638d06ed7 ; affected 057cbf49a1f08297877e46c82f707b1bfea806a8 < 981c97d09c6b9560bb12dcc41f11ce59b1a48e97 ; affected 057cbf49a1f08297877e46c82f707b1bfea806a8 < 6c1b802e36b05ebd9d41686c4dce6f06966af469 |
| Linux · Linux | affected 3.6 ; unaffected 0 < 3.6 ; unaffected 5.10.271 ≤ 5.10.* ; unaffected 5.15.222 ≤ 5.15.* ; unaffected 6.1.189 ≤ 6.1.* ; unaffected 6.6.158 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |