CVE-2025-22083 Overview
CVE-2025-22083 is a use-after-free vulnerability [CWE-416] in the Linux kernel's vhost-scsi subsystem. The flaw occurs when vhost_scsi_set_endpoint is called multiple times without an intervening vhost_scsi_clear_endpoint call. Researcher Haoran Zhang identified three distinct bugs stemming from this behavior: a use-after-free when no target port groups (tpgs) are found, a tpg directory removal hang caused by refcount corruption, and a tpg leak when different target names are supplied across calls.
A local attacker with access to the vhost-scsi device can trigger memory corruption in the host kernel, leading to privilege escalation or denial of service on virtualization hosts.
Critical Impact
Local exploitation of the vhost-scsi interface can lead to kernel memory corruption, host compromise from a virtualization control plane, and denial of service against affected Linux hosts.
Affected Products
- Linux Kernel (multiple stable branches prior to the fix commits)
- Linux Kernel 3.9 (including rc7 and rc8) where vhost-scsi was introduced
- Siemens products bundling affected kernels (see Siemens advisory SSA-019113)
Discovery Timeline
- Vulnerability identified by Haoran Zhang
- 2025-04-16 - CVE-2025-22083 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2025-22083
Vulnerability Analysis
The vhost-scsi driver exposes a virtualization backend used by QEMU to present SCSI devices to guests. The VHOST_SCSI_SET_ENDPOINT ioctl binds a vhost-scsi device to a LIO target and its tpgs. The driver was not designed to be called repeatedly without first clearing the endpoint, but it did not enforce this contract.
When vhost_scsi_set_endpoint runs a second time and finds no matching tpgs, the code skips vhost_vq_set_backend but still frees the previous vs_tpg array via kfree(vs->vs_tpg). A subsequent SCSI request path through vhost_scsi_handle_vq → vhost_scsi_get_req → vhost_vq_get_backend dereferences the freed allocation, producing a classic use-after-free.
Two secondary defects compound the flaw. First, target_undepend_item runs against tpgs already tracked from previous calls, dropping refcounts below zero and hanging later rmdir operations on the tpg directory. Second, when the caller supplies a new target name with previously unseen tpgs, the driver overwrites the target name and vs_tpg array without tearing down the old mapping, leaking tpgs that can no longer be removed.
Root Cause
The root cause is missing state validation in vhost_scsi_set_endpoint. The function permitted re-entry against an already-configured endpoint, causing inconsistent bookkeeping between the vs->vs_tpg array, target_core refcounts, and the backend pointer stored via vhost_vq_set_backend.
Attack Vector
Exploitation requires local access with permission to open /dev/vhost-scsi and issue VHOST_SCSI_SET_ENDPOINT ioctls. An attacker with these privileges issues repeated VHOST_SCSI_SET_ENDPOINT calls under crafted conditions, then triggers I/O on the vhost queue to reach the freed vs_tpg allocation. Reliable exploitation depends on kernel heap layout and slab reuse timing.
See the Kernel Git Commit Change for the corrective patch that blocks a second vhost_scsi_set_endpoint call after tpgs have already been added.
Detection Methods for CVE-2025-22083
Indicators of Compromise
- Kernel oops or KASAN use-after-free reports referencing vhost_scsi_get_req, vhost_vq_get_backend, or vhost_scsi_handle_vq
- Unremovable LIO tpg directories under /sys/kernel/config/target/ returning errors or hanging on rmdir
- Unexpected repeated VHOST_SCSI_SET_ENDPOINT ioctls from non-QEMU processes
Detection Strategies
- Enable KASAN on test kernels to surface use-after-free conditions in vhost-scsi during fuzzing and QA cycles
- Audit /dev/vhost-scsi open events and correlate with subsequent ioctl activity from unexpected user IDs
- Monitor kernel logs for refcount_t warnings tied to target_core_mod and vhost_scsi
Monitoring Recommendations
- Alert on any host kernel panic or BUG: messages in dmesg on virtualization hosts running QEMU with vhost-scsi
- Track configfs operations on LIO targets and flag long-hanging rmdir syscalls
- Baseline the set of processes permitted to interact with /dev/vhost-scsi and alert on new callers
How to Mitigate CVE-2025-22083
Immediate Actions Required
- Update to a Linux kernel version containing the fix commits from kernel.org stable trees
- Restrict access to /dev/vhost-scsi to trusted virtualization service accounts only
- Apply vendor-specific updates, including the Siemens Security Advisory SSA-019113 for affected industrial products
Patch Information
The fix prevents vhost_scsi_set_endpoint from executing when tpgs have already been added, requiring callers to issue vhost_scsi_clear_endpoint first. Patches are available across stable branches, including commits 2b34bdc4, 3a19eb3d, 3fd054ba, 451c72f5, 5dd639a1, and 63b449f7.
Workarounds
- Disable or unload the vhost_scsi kernel module on hosts where it is not required
- Enforce QEMU-only usage patterns; QEMU already gates against repeated VHOST_SCSI_SET_ENDPOINT calls
- Apply mandatory access controls (SELinux, AppArmor) to constrain which processes may open /dev/vhost-scsi
# Verify whether vhost_scsi is loaded and unload if unused
lsmod | grep vhost_scsi
sudo modprobe -r vhost_scsi
# Restrict device node access to a dedicated group
sudo chown root:kvm /dev/vhost-scsi
sudo chmod 0660 /dev/vhost-scsi
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
