CVE-2026-74702: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-74702 Overview

CVE-2026-74702 is a Linux kernel vulnerability in the vhost-scsi subsystem that allows a local privileged user to trigger a kernel BUG_ON() assertion. The flaw resides in vhost_scsi_set_features(), which accepts feature bit changes even after the endpoint is active. Toggling the VIRTIO_SCSI_F_T10_PI bit after endpoint setup leaves the per-command protection scatterlist (prot_sgl) unallocated while the I/O data path proceeds as if T10 Protection Information were enabled. A crafted protection payload spanning 129 pages then hits a BUG_ON(nents > SG_CHUNK_SIZE) inside sg_pool_index(), crashing the host kernel.

Critical Impact
A local user with access to the vhost-scsi device can crash the host kernel or corrupt scatter-gather state, affecting virtualization hosts running KVM/QEMU guests backed by vhost-scsi.

Affected Products

Linux kernel builds containing the vhost_scsi module prior to the referenced fix commits
Virtualization hosts using vhost-scsi for KVM/QEMU storage acceleration
Stable kernel trees receiving the backported patches 42bc45df5905, 9a3eb77a612f, and a06e4611d455

Discovery Timeline

2026-08-22 - CVE-2026-74702 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74702

Vulnerability Analysis

The vulnerability originates in the vhost-scsi command setup path. vhost_scsi_setup_vq_cmds() runs from the VHOST_SCSI_SET_ENDPOINT ioctl and allocates each command's protection scatterlist array based on the currently acknowledged VIRTIO_SCSI_F_T10_PI bit. The command pools are not rebuilt when VHOST_SET_FEATURES later changes that bit.

Although the virtio specification prohibits changing feature bits after negotiation, vhost_scsi_set_features() did not enforce this constraint. Enabling T10-PI after endpoint setup leaves prot_sgl as NULL while the data path follows the new feature bit. For a 129-page protection payload, vhost_scsi_mapal() calls sg_alloc_table_chained() with a NULL first chunk. The chained allocator then reaches sg_pool_index() where BUG_ON(nents > SG_CHUNK_SIZE) fires because 129 exceeds the 128-entry chunk limit.

The fix rejects changes to any feature other than VHOST_F_LOG_ALL while the endpoint is active, preserving the runtime dirty-log toggle while preventing feature-dependent command resources from becoming inconsistent.

Root Cause

The root cause is missing state validation during feature negotiation. vhost_scsi_set_features() updates acked_features without verifying whether the endpoint is already active, breaking the invariant that command pool allocation matches the negotiated feature set. This is a kernel state-management flaw that leads to a NULL pointer/inconsistent state condition reachable from the I/O path.

Attack Vector

An attacker requires local access with sufficient privileges to open /dev/vhost-scsi and issue ioctls. The exploitation sequence involves calling VHOST_SCSI_SET_ENDPOINT without VIRTIO_SCSI_F_T10_PI acknowledged, then issuing VHOST_SET_FEATURES to enable T10-PI, then submitting a SCSI command whose protection payload requires more than 128 scatterlist entries. This triggers the BUG_ON and produces a host kernel panic. Full technical detail is available in the kernel commit reference.

Detection Methods for CVE-2026-74702

Indicators of Compromise

Kernel oops or panic messages referencing sg_alloc_table_chained, sg_pool_index, or vhost_scsi_handle_vq in dmesg or /var/log/kern.log
BUG_ON assertion traces citing nents > SG_CHUNK_SIZE originating from the vhost_scsi module
Unexpected virtual machine host crashes coinciding with guest SCSI feature renegotiation

Detection Strategies

Audit ioctl calls to /dev/vhost-scsi for VHOST_SET_FEATURES invocations that occur after VHOST_SCSI_SET_ENDPOINT on the same file descriptor
Monitor kernel logs for repeated crashes in the vhost_scsi_handle_kick call path
Inventory hosts running kernels that do not include commits 42bc45df5905, 9a3eb77a612f, or a06e4611d455

Monitoring Recommendations

Forward host kernel logs to a centralized logging platform and alert on vhost_scsi module crash signatures
Track VM host uptime anomalies and correlate with guest storage configuration changes
Enable kernel crash dump capture (kdump) on virtualization hosts to preserve forensic evidence

How to Mitigate CVE-2026-74702

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable tree as soon as vendor updates are available
Restrict access to /dev/vhost-scsi to trusted virtualization service accounts only
Audit which local users and processes hold permissions on vhost device nodes

Patch Information

The fix is committed to the mainline and stable Linux kernel trees. The relevant commits are 42bc45df5905e2b7dccb72adaf7730f66cfbe03f, 9a3eb77a612f9d158e4d27df43677a014e9cfa55, and a06e4611d45518896fbff4f45d9581578b107e91. The patch rejects any feature change other than VHOST_F_LOG_ALL while the endpoint is active, forcing userspace to clear the endpoint before renegotiating features. Consult your Linux distribution's security tracker for the specific package versions containing the backport.

Workarounds

Disable the vhost_scsi kernel module on hosts that do not require it using modprobe -r vhost_scsi and blacklist it in /etc/modprobe.d/
Configure QEMU to use alternative SCSI backends such as virtio-scsi-pci in userspace mode until the patch is applied
Enforce mandatory access controls (SELinux, AppArmor) to prevent unauthorized processes from opening /dev/vhost-scsi

bash

# Configuration example: disable vhost_scsi where not required
sudo modprobe -r vhost_scsi
echo "blacklist vhost_scsi" | sudo tee /etc/modprobe.d/blacklist-vhost-scsi.conf
sudo chmod 0600 /dev/vhost-scsi