{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38074", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.980Z", "datePublished": "2025-06-18T09:33:50.006Z", "dateUpdated": "2026-08-05T11:59:14.881Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:59:14.881Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: protect vq->log_used with vq->mutex\n\nThe vhost-scsi completion path may access vq->log_base when vq->log_used is\nalready set to false.\n\n vhost-thread QEMU-thread\n\nvhost_scsi_complete_cmd_work()\n-> vhost_add_used()\n -> vhost_add_used_n()\n if (unlikely(vq->log_used))\n QEMU disables vq->log_used\n via VHOST_SET_VRING_ADDR.\n mutex_lock(&vq->mutex);\n vq->log_used = false now!\n mutex_unlock(&vq->mutex);\n\n\t\t\t\t QEMU gfree(vq->log_base)\n log_used()\n -> log_write(vq->log_base)\n\nAssuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be\nreclaimed via gfree(). As a result, this causes invalid memory writes to\nQEMU userspace.\n\nThe control queue path has the same issue." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - vhost-scsi is a host-kernel backend driven by a guest VM through its virtqueues and by the VMM through /dev/vhost-scsi ioctls; there is no network-facing path, so the attacker acts from a local context (inside a guest on the host, or a local host process holding the vhost fd).\nAC:L - The attacker controls both sides of the race — a continuous stream of guest SCSI I/O keeps the unlocked completion worker running, and a guest-initiated virtio device reset forces QEMU's vhost_dev_stop() to clear log_used and free the log bitmap; the window is wide because the entire completion loop ran with no lock at all, and each command issues multiple log_write() calls.\nPR:L - The attacker needs to be an authorized guest tenant driving the virtio-scsi device (or a local host process with the vhost-scsi fd); no host root or elevated host capability is required, and ordinary unprivileged guest I/O suffices to keep the completion path armed.\nUI:N - No victim action is needed — the guest can itself force the log-teardown path via a virtio device reset or feature renegotiation while completions are in flight, and the migration-end teardown is a routine automated host operation, not a tricked user action.\nS:C - The vulnerable component is the host kernel's vhost-scsi driver, but the corrupted resource is the host VMM (QEMU) userspace address space, reached from inside a guest — the guest confinement boundary is crossed, matching the guest-to-host escape case.\nC:H - Guest-influenced bit-sets at attacker-chosen offsets from a stale log_base corrupt live QEMU heap objects (pointers, lengths, migration bitmap state), which is leverageable to disclose host memory back into the guest.\nI:H - This is an out-of-bounds/use-after-free write into the host VMM process with attacker-controlled offset and multiplicity, enabling corruption of QEMU control structures and hence control-flow hijack, and it silently corrupts the migration dirty bitmap so migrated guest state is written incorrectly.\nA:H - Corrupting glib heap metadata aborts QEMU and terminates the VM, migrations fail or complete with corrupt state, and set_bit_to_user()'s BUG_ON(r != 1) can be reached when the stale log page is no longer pinnable." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/vhost/scsi.c" ], "versions": [ { "version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "lessThan": "80cf68489681c165ded460930e391b1eb37b5f6f", "status": "affected", "versionType": "git" }, { "version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "lessThan": "8312a1ccff1566f375191a89b9ba71b6eb48a8cd", "status": "affected", "versionType": "git" }, { "version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "lessThan": "59614c5acf6688f7af3c245d359082c0e9e53117", "status": "affected", "versionType": "git" }, { "version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "lessThan": "ca85c2d0db5f8309832be45858b960d933c2131c", "status": "affected", "versionType": "git" }, { "version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "lessThan": "bd8c9404e44adb9f6219c09b3409a61ab7ce3427", "status": "affected", "versionType": "git" }, { "version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "lessThan": "c0039e3afda29be469d29b3013d7f9bdee136834", "status": "affected", "versionType": "git" }, { "version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "lessThan": "f591cf9fce724e5075cc67488c43c6e39e8cbe27", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/vhost/scsi.c" ], "versions": [ { "version": "3.6", "status": "affected" }, { "version": "0", "lessThan": "3.6", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.240", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.189", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.146", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.93", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.31", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.9", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.10.240" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.15.189" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.1.146" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.6.93" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.12.31" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.14.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/80cf68489681c165ded460930e391b1eb37b5f6f" }, { "url": "https://git.kernel.org/stable/c/8312a1ccff1566f375191a89b9ba71b6eb48a8cd" }, { "url": "https://git.kernel.org/stable/c/59614c5acf6688f7af3c245d359082c0e9e53117" }, { "url": "https://git.kernel.org/stable/c/ca85c2d0db5f8309832be45858b960d933c2131c" }, { "url": "https://git.kernel.org/stable/c/bd8c9404e44adb9f6219c09b3409a61ab7ce3427" }, { "url": "https://git.kernel.org/stable/c/c0039e3afda29be469d29b3013d7f9bdee136834" }, { "url": "https://git.kernel.org/stable/c/f591cf9fce724e5075cc67488c43c6e39e8cbe27" } ], "title": "vhost-scsi: protect vq->log_used with vq->mutex", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:33:42.169Z" } } ] } }