CVE-2026-74703: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-74703 Overview

CVE-2026-74703 is a Linux kernel vulnerability in the vhost-scsi driver affecting T10 Protection Information (PI) request handling. When T10 PI is negotiated, vhost-scsi separates protection bytes from the data iterator before mapping request scatterlists. A malformed guest request can declare protection bytes that cover or exceed the total payload length. This condition results in a zero data scatter-gather list (SGL) count reaching sg_alloc_table_chained(), which triggers BUG_ON(!nents) and crashes the host kernel.

Critical Impact
A local attacker with the ability to submit crafted SCSI requests through a vhost-scsi virtqueue can trigger a kernel BUG_ON, causing a denial of service on the host.

Affected Products

Linux kernel with vhost-scsi driver enabled
Host systems using vhost-scsi to expose SCSI targets to virtual machines
KVM/QEMU virtualization stacks relying on vhost-scsi with T10 PI negotiation

Discovery Timeline

2026-08-22 - CVE-2026-74703 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74703

Vulnerability Analysis

The defect resides in the vhost-scsi request path that handles T10 Protection Information. T10 PI adds integrity metadata to SCSI I/O, and vhost-scsi splits those protection bytes from the payload before building scatter-gather lists. The driver subtracts prot_bytes from exp_data_len and advances the request iterator, then allocates a chained SG table for the remaining data.

The validation logic does not reject requests where prot_bytes equals or exceeds exp_data_len. When prot_bytes equals the payload, no data bytes remain to map. When prot_bytes exceeds the payload, exp_data_len underflows before the iterator advance. Both conditions produce a zero nents value passed to sg_alloc_table_chained(), which asserts BUG_ON(!nents) and panics the kernel.

The fix rejects protection lengths that cover or exceed the payload before subtracting prot_bytes and advancing the iterator. It also propagates negative errors from the protection SGL calculation before invoking the allocator, matching the data SGL error path.

Root Cause

The root cause is missing input validation on attacker-controlled length fields in the vhost-scsi request descriptor. The driver trusted the relationship between prot_bytes and exp_data_len without bounds checking, allowing a malformed request to produce a zero-element SGL.

Attack Vector

Exploitation requires local access to submit crafted requests to a vhost-scsi virtqueue. A guest VM operator or a local user with the required capabilities can send a SCSI command whose declared protection length equals or exceeds the total data length. The malformed request reaches sg_alloc_table_chained() with nents = 0, triggering the kernel BUG_ON and a host-side denial of service.

No verified public exploit code is available. Technical details are documented in the upstream commits referenced in the Kernel Git commit log.

Detection Methods for CVE-2026-74703

Indicators of Compromise

Unexpected host kernel panics or BUG_ON traces referencing sg_alloc_table_chained and vhost_scsi in dmesg or /var/log/kern.log.
Repeated guest-initiated SCSI errors immediately preceding a host crash or virtqueue reset.
Loss of vhost-scsi-backed VM I/O correlated with kernel oops entries in system journals.

Detection Strategies

Monitor kernel logs on virtualization hosts for BUG_ON(!nents) and stack traces containing vhost_scsi_prepare_cmd or sg_alloc_table_chained.
Enable kernel crash dump collection (kdump) to capture panic context for post-incident analysis.
Track host uptime and unexpected reboots on hypervisors that expose vhost-scsi targets to untrusted guests.

Monitoring Recommendations

Forward host kernel logs to a centralized log platform and alert on vhost_scsi panic signatures.
Baseline SCSI error rates per guest and alert on anomalous spikes that may precede exploitation attempts.
Track kernel package versions across the fleet to identify hosts still running vulnerable builds.

How to Mitigate CVE-2026-74703

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the commits 2417a498cf3f, d876c493fc4b, and f8fe3f8d342d.
Update to the stable kernel release from your distribution that includes the vhost-scsi T10 PI validation fix.
Restrict local access on virtualization hosts to trusted operators until patches are deployed.

Patch Information

The fix is available in the upstream stable trees. Review the patch content in the kernel commit 2417a498cf3f, kernel commit d876c493fc4b, and kernel commit f8fe3f8d342d. Distribution vendors ship the fix through their standard kernel update channels.

Workarounds

Disable the vhost_scsi kernel module on hosts that do not require it: modprobe -r vhost_scsi and blacklist the module.
Avoid negotiating T10 PI on vhost-scsi targets exposed to untrusted guests until patched kernels are deployed.
Limit which guests can attach to vhost-scsi backends by tightening libvirt and QEMU permissions.

bash

# Verify kernel version and vhost_scsi module status
uname -r
lsmod | grep vhost_scsi

# Optional: blacklist vhost_scsi if not required
echo 'blacklist vhost_scsi' | sudo tee /etc/modprobe.d/disable-vhost-scsi.conf
sudo modprobe -r vhost_scsi