{"id":"CVE-2025-38074","state":"PUBLISHED","title":"vhost-scsi: protect vq->log_used with vq->mutex","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: protect vq->log_used with vq->mutex\n\nThe vhost-scsi completion path may access vq->log_base when vq->log_used is\nalready set to false.\n\n    vhost-thread                       QEMU-thread\n\nvhost_scsi_complete_cmd_work()\n-> vhost_add_used()\n   -> vhost_add_used_n()\n      if (unlikely(vq->log_used))\n                                      QEMU disables vq->log_used\n                                      via VHOST_SET_VRING_ADDR.\n                                      mutex_lock(&vq->mutex);\n                                      vq->log_used = false now!\n                                      mutex_unlock(&vq->mutex);\n\n\t\t\t\t      QEMU gfree(vq->log_base)\n        log_used()\n        -> log_write(vq->log_base)\n\nAssuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be\nreclaimed via gfree(). As a result, this causes invalid memory writes to\nQEMU userspace.\n\nThe control queue path has the same issue.","publishedAt":"2025-06-18T09:33:50.006Z","updatedAt":"2026-08-05T11:59:14.881Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","status":"affected","lessThan":"80cf68489681c165ded460930e391b1eb37b5f6f","versionType":"git"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","status":"affected","lessThan":"8312a1ccff1566f375191a89b9ba71b6eb48a8cd","versionType":"git"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","status":"affected","lessThan":"59614c5acf6688f7af3c245d359082c0e9e53117","versionType":"git"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","status":"affected","lessThan":"ca85c2d0db5f8309832be45858b960d933c2131c","versionType":"git"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","status":"affected","lessThan":"bd8c9404e44adb9f6219c09b3409a61ab7ce3427","versionType":"git"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","status":"affected","lessThan":"c0039e3afda29be469d29b3013d7f9bdee136834","versionType":"git"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","status":"affected","lessThan":"f591cf9fce724e5075cc67488c43c6e39e8cbe27","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/vhost/scsi.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.6","versionType":"semver"},{"version":"5.10.240","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.189","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.146","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.93","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.31","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.14.9","status":"unaffected","lessThanOrEqual":"6.14.*","versionType":"semver"},{"version":"6.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/vhost/scsi.c"]}],"references":["https://git.kernel.org/stable/c/80cf68489681c165ded460930e391b1eb37b5f6f","https://git.kernel.org/stable/c/8312a1ccff1566f375191a89b9ba71b6eb48a8cd","https://git.kernel.org/stable/c/59614c5acf6688f7af3c245d359082c0e9e53117","https://git.kernel.org/stable/c/ca85c2d0db5f8309832be45858b960d933c2131c","https://git.kernel.org/stable/c/bd8c9404e44adb9f6219c09b3409a61ab7ce3427","https://git.kernel.org/stable/c/c0039e3afda29be469d29b3013d7f9bdee136834","https://git.kernel.org/stable/c/f591cf9fce724e5075cc67488c43c6e39e8cbe27","https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/38xxx/CVE-2025-38074.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-38074","state":"PUBLISHED","datePublished":"2025-06-18T09:33:50.006Z","dateUpdated":"2026-08-05T11:59:14.881Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T04:51:23.980Z"},"containers":{"cna":{"title":"vhost-scsi: protect vq->log_used with vq->mutex","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: protect vq->log_used with vq->mutex\n\nThe vhost-scsi completion path may access vq->log_base when vq->log_used is\nalready set to false.\n\n    vhost-thread                       QEMU-thread\n\nvhost_scsi_complete_cmd_work()\n-> vhost_add_used()\n   -> vhost_add_used_n()\n      if (unlikely(vq->log_used))\n                                      QEMU disables vq->log_used\n                                      via VHOST_SET_VRING_ADDR.\n                                      mutex_lock(&vq->mutex);\n                                      vq->log_used = false now!\n                                      mutex_unlock(&vq->mutex);\n\n\t\t\t\t      QEMU gfree(vq->log_base)\n        log_used()\n        -> log_write(vq->log_base)\n\nAssuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be\nreclaimed via gfree(). As a result, this causes invalid memory writes to\nQEMU userspace.\n\nThe control queue path has the same issue."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","status":"affected","lessThan":"80cf68489681c165ded460930e391b1eb37b5f6f","versionType":"git"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","status":"affected","lessThan":"8312a1ccff1566f375191a89b9ba71b6eb48a8cd","versionType":"git"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","status":"affected","lessThan":"59614c5acf6688f7af3c245d359082c0e9e53117","versionType":"git"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","status":"affected","lessThan":"ca85c2d0db5f8309832be45858b960d933c2131c","versionType":"git"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","status":"affected","lessThan":"bd8c9404e44adb9f6219c09b3409a61ab7ce3427","versionType":"git"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","status":"affected","lessThan":"c0039e3afda29be469d29b3013d7f9bdee136834","versionType":"git"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","status":"affected","lessThan":"f591cf9fce724e5075cc67488c43c6e39e8cbe27","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/vhost/scsi.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.6","versionType":"semver"},{"version":"5.10.240","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.189","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.146","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.93","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.31","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.14.9","status":"unaffected","lessThanOrEqual":"6.14.*","versionType":"semver"},{"version":"6.15","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/vhost/scsi.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/80cf68489681c165ded460930e391b1eb37b5f6f"},{"url":"https://git.kernel.org/stable/c/8312a1ccff1566f375191a89b9ba71b6eb48a8cd"},{"url":"https://git.kernel.org/stable/c/59614c5acf6688f7af3c245d359082c0e9e53117"},{"url":"https://git.kernel.org/stable/c/ca85c2d0db5f8309832be45858b960d933c2131c"},{"url":"https://git.kernel.org/stable/c/bd8c9404e44adb9f6219c09b3409a61ab7ce3427"},{"url":"https://git.kernel.org/stable/c/c0039e3afda29be469d29b3013d7f9bdee136834"},{"url":"https://git.kernel.org/stable/c/f591cf9fce724e5075cc67488c43c6e39e8cbe27"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - vhost-scsi is a host-kernel backend driven by a guest VM through its virtqueues and by the VMM through /dev/vhost-scsi ioctls; there is no network-facing path, so the attacker acts from a local context (inside a guest on the host, or a local host process holding the vhost fd).\nAC:L - The attacker controls both sides of the race — a continuous stream of guest SCSI I/O keeps the unlocked completion worker running, and a guest-initiated virtio device reset forces QEMU's vhost_dev_stop() to clear log_used and free the log bitmap; the window is wide because the entire completion loop ran with no lock at all, and each command issues multiple log_write() calls.\nPR:L - The attacker needs to be an authorized guest tenant driving the virtio-scsi device (or a local host process with the vhost-scsi fd); no host root or elevated host capability is required, and ordinary unprivileged guest I/O suffices to keep the completion path armed.\nUI:N - No victim action is needed — the guest can itself force the log-teardown path via a virtio device reset or feature renegotiation while completions are in flight, and the migration-end teardown is a routine automated host operation, not a tricked user action.\nS:C - The vulnerable component is the host kernel's vhost-scsi driver, but the corrupted resource is the host VMM (QEMU) userspace address space, reached from inside a guest — the guest confinement boundary is crossed, matching the guest-to-host escape case.\nC:H - Guest-influenced bit-sets at attacker-chosen offsets from a stale log_base corrupt live QEMU heap objects (pointers, lengths, migration bitmap state), which is leverageable to disclose host memory back into the guest.\nI:H - This is an out-of-bounds/use-after-free write into the host VMM process with attacker-controlled offset and multiplicity, enabling corruption of QEMU control structures and hence control-flow hijack, and it silently corrupts the migration dirty bitmap so migrated guest state is written incorrectly.\nA:H - Corrupting glib heap metadata aborts QEMU and terminates the VM, migrations fail or complete with corrupt state, and set_bit_to_user()'s BUG_ON(r != 1) can be reached when the stale log page is no longer pinnable."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:59:14.881Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.10.240"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.15.189"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.1.146"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.6.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.12.31"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.14.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.15"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T17:33:42.169Z"}}]}}}