In the Linux kernel, the following vulnerability has been resolved:
vhost-scsi: protect vq->log_used with vq->mutex
The vhost-scsi completion path may access vq->logbase when vq->logused is already set to false.
vhost-thread QEMU-thread
vhostscsicompletecmdwork() -> vhostaddused() -> vhostaddusedn() if (unlikely(vq->logused)) QEMU disables vq->logused via VHOSTSETVRINGADDR. mutexlock(&vq->mutex); vq->logused = false now! mutex_unlock(&vq->mutex);
QEMU gfree(vq->log_base)
log_used()
-> log_write(vq->log_base)
Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be reclaimed via gfree(). As a result, this causes invalid memory writes to QEMU userspace.
The control queue path has the same issue.
[
{
"signature_type": "Function",
"digest": {
"function_hash": "177778537547051782509092973718940031095",
"length": 405.0
},
"target": {
"file": "drivers/vhost/scsi.c",
"function": "vhost_scsi_tmf_resp_work"
},
"signature_version": "v1",
"id": "CVE-2025-38074-017c8aa6",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59614c5acf6688f7af3c245d359082c0e9e53117"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "108701687313304932696966969084761465232",
"length": 1457.0
},
"target": {
"file": "drivers/vhost/scsi.c",
"function": "vhost_scsi_complete_cmd_work"
},
"signature_version": "v1",
"id": "CVE-2025-38074-03458d0d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59614c5acf6688f7af3c245d359082c0e9e53117"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "177778537547051782509092973718940031095",
"length": 405.0
},
"target": {
"file": "drivers/vhost/scsi.c",
"function": "vhost_scsi_tmf_resp_work"
},
"signature_version": "v1",
"id": "CVE-2025-38074-04726b43",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f591cf9fce724e5075cc67488c43c6e39e8cbe27"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "337982515858397355623826718009501941187",
"length": 1315.0
},
"target": {
"file": "drivers/vhost/scsi.c",
"function": "vhost_scsi_complete_cmd_work"
},
"signature_version": "v1",
"id": "CVE-2025-38074-13bf584f",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca85c2d0db5f8309832be45858b960d933c2131c"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "177778537547051782509092973718940031095",
"length": 405.0
},
"target": {
"file": "drivers/vhost/scsi.c",
"function": "vhost_scsi_tmf_resp_work"
},
"signature_version": "v1",
"id": "CVE-2025-38074-236b1e29",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd8c9404e44adb9f6219c09b3409a61ab7ce3427"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "5009575051861547395236816919418907080",
"length": 1463.0
},
"target": {
"file": "drivers/vhost/scsi.c",
"function": "vhost_scsi_complete_cmd_work"
},
"signature_version": "v1",
"id": "CVE-2025-38074-3865aeb2",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8312a1ccff1566f375191a89b9ba71b6eb48a8cd"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"192883207210939567192054174865849272415",
"138550198307682974532650488189368885326",
"270517148323312195178066616184486327041",
"82819097379800324586196419727363288982",
"27561289504756925912831739583713142276",
"219456037898708096805171458796308718044",
"219032029800871563998571346114471933787",
"118255645930680902689617479230539067217",
"288841525179592276687282861808474122262",
"82717132141454996644443108508211359758",
"175979009603143371961346858754084194661",
"67581069173670241221743237864591861064"
]
},
"target": {
"file": "drivers/vhost/scsi.c"
},
"signature_version": "v1",
"id": "CVE-2025-38074-461f96da",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f591cf9fce724e5075cc67488c43c6e39e8cbe27"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "177778537547051782509092973718940031095",
"length": 405.0
},
"target": {
"file": "drivers/vhost/scsi.c",
"function": "vhost_scsi_tmf_resp_work"
},
"signature_version": "v1",
"id": "CVE-2025-38074-6c2a470f",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0039e3afda29be469d29b3013d7f9bdee136834"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "177778537547051782509092973718940031095",
"length": 405.0
},
"target": {
"file": "drivers/vhost/scsi.c",
"function": "vhost_scsi_tmf_resp_work"
},
"signature_version": "v1",
"id": "CVE-2025-38074-6ecfccce",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8312a1ccff1566f375191a89b9ba71b6eb48a8cd"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "223151943018014255464037455258631065195",
"length": 700.0
},
"target": {
"file": "drivers/vhost/scsi.c",
"function": "vhost_scsi_tmf_resp_work"
},
"signature_version": "v1",
"id": "CVE-2025-38074-8d26698e",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca85c2d0db5f8309832be45858b960d933c2131c"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "337982515858397355623826718009501941187",
"length": 1315.0
},
"target": {
"file": "drivers/vhost/scsi.c",
"function": "vhost_scsi_complete_cmd_work"
},
"signature_version": "v1",
"id": "CVE-2025-38074-ad02f2f8",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd8c9404e44adb9f6219c09b3409a61ab7ce3427"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"84784802240300369283275192179704791050",
"312465745838255797691146658661632315608",
"334943973686372781879164641900162817511",
"328754745196106274648331922018154157532",
"83907508013495299416845930864096766055",
"118255645930680902689617479230539067217",
"288841525179592276687282861808474122262",
"82717132141454996644443108508211359758",
"175979009603143371961346858754084194661",
"336487707892203683093378831717253071177"
]
},
"target": {
"file": "drivers/vhost/scsi.c"
},
"signature_version": "v1",
"id": "CVE-2025-38074-b272c48f",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59614c5acf6688f7af3c245d359082c0e9e53117"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"192883207210939567192054174865849272415",
"138550198307682974532650488189368885326",
"270517148323312195178066616184486327041",
"82819097379800324586196419727363288982",
"27561289504756925912831739583713142276",
"219456037898708096805171458796308718044",
"219032029800871563998571346114471933787",
"118255645930680902689617479230539067217",
"288841525179592276687282861808474122262",
"82717132141454996644443108508211359758",
"175979009603143371961346858754084194661",
"67581069173670241221743237864591861064"
]
},
"target": {
"file": "drivers/vhost/scsi.c"
},
"signature_version": "v1",
"id": "CVE-2025-38074-bacfa40e",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd8c9404e44adb9f6219c09b3409a61ab7ce3427"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "337982515858397355623826718009501941187",
"length": 1315.0
},
"target": {
"file": "drivers/vhost/scsi.c",
"function": "vhost_scsi_complete_cmd_work"
},
"signature_version": "v1",
"id": "CVE-2025-38074-d22da27b",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0039e3afda29be469d29b3013d7f9bdee136834"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"84784802240300369283275192179704791050",
"312465745838255797691146658661632315608",
"334943973686372781879164641900162817511",
"72596038658747982808098621153667004288",
"66157486124387099550027525318459530209",
"118255645930680902689617479230539067217",
"288841525179592276687282861808474122262",
"82717132141454996644443108508211359758",
"175979009603143371961346858754084194661",
"336487707892203683093378831717253071177"
]
},
"target": {
"file": "drivers/vhost/scsi.c"
},
"signature_version": "v1",
"id": "CVE-2025-38074-da0f3348",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8312a1ccff1566f375191a89b9ba71b6eb48a8cd"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "177778537547051782509092973718940031095",
"length": 405.0
},
"target": {
"file": "drivers/vhost/scsi.c",
"function": "vhost_scsi_tmf_resp_work"
},
"signature_version": "v1",
"id": "CVE-2025-38074-e40d9f43",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80cf68489681c165ded460930e391b1eb37b5f6f"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"192883207210939567192054174865849272415",
"138550198307682974532650488189368885326",
"270517148323312195178066616184486327041",
"82819097379800324586196419727363288982",
"27561289504756925912831739583713142276",
"219456037898708096805171458796308718044",
"219032029800871563998571346114471933787",
"167358080349032076398453178528882258103",
"311251964942134240244924381888249943150",
"88300788415247182735946288112318525786",
"175979009603143371961346858754084194661",
"336487707892203683093378831717253071177"
]
},
"target": {
"file": "drivers/vhost/scsi.c"
},
"signature_version": "v1",
"id": "CVE-2025-38074-e53c7590",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca85c2d0db5f8309832be45858b960d933c2131c"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"84784802240300369283275192179704791050",
"312465745838255797691146658661632315608",
"334943973686372781879164641900162817511",
"72596038658747982808098621153667004288",
"66157486124387099550027525318459530209",
"118255645930680902689617479230539067217",
"288841525179592276687282861808474122262",
"82717132141454996644443108508211359758",
"175979009603143371961346858754084194661",
"336487707892203683093378831717253071177"
]
},
"target": {
"file": "drivers/vhost/scsi.c"
},
"signature_version": "v1",
"id": "CVE-2025-38074-e60338b6",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80cf68489681c165ded460930e391b1eb37b5f6f"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "195076161304214308707120549063847877409",
"length": 1316.0
},
"target": {
"file": "drivers/vhost/scsi.c",
"function": "vhost_scsi_complete_cmd_work"
},
"signature_version": "v1",
"id": "CVE-2025-38074-f2635c01",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f591cf9fce724e5075cc67488c43c6e39e8cbe27"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"192883207210939567192054174865849272415",
"138550198307682974532650488189368885326",
"270517148323312195178066616184486327041",
"82819097379800324586196419727363288982",
"27561289504756925912831739583713142276",
"219456037898708096805171458796308718044",
"219032029800871563998571346114471933787",
"118255645930680902689617479230539067217",
"288841525179592276687282861808474122262",
"82717132141454996644443108508211359758",
"175979009603143371961346858754084194661",
"67581069173670241221743237864591861064"
]
},
"target": {
"file": "drivers/vhost/scsi.c"
},
"signature_version": "v1",
"id": "CVE-2025-38074-f4375b2a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0039e3afda29be469d29b3013d7f9bdee136834"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "5009575051861547395236816919418907080",
"length": 1463.0
},
"target": {
"file": "drivers/vhost/scsi.c",
"function": "vhost_scsi_complete_cmd_work"
},
"signature_version": "v1",
"id": "CVE-2025-38074-f5dae163",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80cf68489681c165ded460930e391b1eb37b5f6f"
}
]