CVE-2026-74702

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vhost-scsi: reject feature changes after endpoint<br /> <br /> vhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates<br /> each command&amp;#39;s protection scatterlist array (prot_sgl) according to the<br /> acknowledged VIRTIO_SCSI_F_T10_PI bit. The command pools are not rebuilt<br /> when VHOST_SET_FEATURES changes that bit later.<br /> <br /> Although virtio feature bits must not change after feature negotiation,<br /> vhost_scsi_set_features() currently accepts such a request after the<br /> endpoint is active and updates acked_features. Enabling T10-PI after<br /> endpoint setup therefore leaves prot_sgl NULL while the I/O path follows<br /> the new feature bit.<br /> <br /> For a 129-page protection payload, vhost_scsi_mapal() passes the missing<br /> first chunk to sg_alloc_table_chained():<br /> <br /> sg_alloc_table_chained(table, 129, first_chunk=NULL,<br /> nents_first_chunk=inline_sg_cnt)<br /> <br /> sg_pool_index() then hits:<br /> <br /> BUG_ON(nents &gt; SG_CHUNK_SIZE); /* 129 &gt; 128 */<br /> <br /> The kernel reported the following call trace and register state:<br /> <br /> Call Trace:<br /> <br /> ? __sg_alloc_table+0x1d8/0x250<br /> ? __pfx_vhost_run_work_list+0x10/0x10 [vhost]<br /> sg_alloc_table_chained+0x59/0xf0<br /> ? __pfx_sg_pool_alloc+0x10/0x10<br /> ? vhost_scsi_calc_sgls.constprop.0+0x43/0x60 [vhost_scsi]<br /> vhost_scsi_handle_vq+0xf02/0x1700 [vhost_scsi]<br /> ? __pfx_vhost_scsi_handle_vq+0x10/0x10 [vhost_scsi]<br /> vhost_scsi_handle_kick+0x37/0x50 [vhost_scsi]<br /> vhost_run_work_list+0x8e/0xd0 [vhost]<br /> vhost_task_fn+0xe1/0x210<br /> ret_from_fork+0x348/0x540<br /> <br /> <br /> RIP: 0010:0x4<br /> CR2 = 0x4<br /> RSP: 0018:ffffc90000dbf940 EFLAGS: 00010202<br /> RAX: ffffffff82396810 RBX: ffff88811dc28b80 RCX: 0000000000000000<br /> RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000081<br /> <br /> VHOST_F_LOG_ALL is a vhost-specific runtime feature and remains the only<br /> exception.<br /> <br /> Reject changes to any feature other than VHOST_F_LOG_ALL while the<br /> endpoint is active. This preserves the existing runtime log toggle while<br /> preventing feature-dependent command resources and data-path state from<br /> becoming inconsistent. Userspace must clear the endpoint before changing<br /> any other negotiated feature and set the endpoint up again afterward.