CVE-2026-74703: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protection bytes that cover or exceed the full payload length. The former leaves no data bytes to map, while the latter underflows exp_data_len before advancing the iterator. Both cases can let a zero data SGL count reach sg_alloc_table_chained(), which triggers BUG_ON(!nents). Reject protection lengths that cover or exceed the payload before subtracting prot_bytes and advancing the iterator. Also propagate negative errors from the protection SGL calculation before calling the allocator, matching the data SGL path.

Засегнати продукти

• Linux Linux: bca939d5bcd00d6faea99c47eafd60bed573ef03 преди 2417a498cf3fe64d06faf87e236eda98dd4f04e0; bca939d5bcd00d6faea99c47eafd60bed573ef03 преди f8fe3f8d342da750dd10361bf66009fd3072926b; bca939d5bcd00d6faea99c47eafd60bed573ef03 преди d876c493fc4b811941bfeb4c80beb2dfc4bf025e
• Linux Linux: 6.15; преди 6.15; 6.18.45 до 6.18.*; 7.1.9 до 7.1.*; от 7.2 нататък

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99265
• CVE-2026-99261
• CVE-2026-99260

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-74703
• https://nvd.nist.gov/vuln/detail/CVE-2026-74703
• https://git.kernel.org/stable/c/2417a498cf3fe64d06faf87e236eda98dd4f04e0
• https://git.kernel.org/stable/c/f8fe3f8d342da750dd10361bf66009fd3072926b
• https://git.kernel.org/stable/c/d876c493fc4b811941bfeb4c80beb2dfc4bf025e