CVE-2026-74703

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vhost-scsi: Validate T10 PI scatterlist counts<br /> <br /> When T10 PI is negotiated, vhost-scsi splits protection bytes from<br /> the data iterator before mapping the request scatterlists. A malformed<br /> request can claim protection bytes that cover or exceed the full payload<br /> length. The former leaves no data bytes to map, while the latter<br /> underflows exp_data_len before advancing the iterator. Both cases can let<br /> a zero data SGL count reach sg_alloc_table_chained(), which triggers<br /> BUG_ON(!nents).<br /> <br /> Reject protection lengths that cover or exceed the payload before<br /> subtracting prot_bytes and advancing the iterator. Also propagate<br /> negative errors from the protection SGL calculation before calling the<br /> allocator, matching the data SGL path.