CVE-2025-38074

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vhost-scsi: protect vq-&gt;log_used with vq-&gt;mutex<br /> <br /> The vhost-scsi completion path may access vq-&gt;log_base when vq-&gt;log_used is<br /> already set to false.<br /> <br /> vhost-thread QEMU-thread<br /> <br /> vhost_scsi_complete_cmd_work()<br /> -&gt; vhost_add_used()<br /> -&gt; vhost_add_used_n()<br /> if (unlikely(vq-&gt;log_used))<br /> QEMU disables vq-&gt;log_used<br /> via VHOST_SET_VRING_ADDR.<br /> mutex_lock(&amp;vq-&gt;mutex);<br /> vq-&gt;log_used = false now!<br /> mutex_unlock(&amp;vq-&gt;mutex);<br /> <br /> QEMU gfree(vq-&gt;log_base)<br /> log_used()<br /> -&gt; log_write(vq-&gt;log_base)<br /> <br /> Assuming the VMM is QEMU. The vq-&gt;log_base is from QEMU userpace and can be<br /> reclaimed via gfree(). As a result, this causes invalid memory writes to<br /> QEMU userspace.<br /> <br /> The control queue path has the same issue.