CyberRota Analysis
AI-GeneratedA vulnerability in the Linux kernel's vhost-scsi component allows a malformed T10 PI request to manipulate protection byte counts, potentially leading to a zero data scatter-gather list (SGL) count. This can trigger a critical failure in the system, causing a BUG_ON condition. Organizations using Linux systems with vhost-scsi should prioritize addressing this issue to prevent potential system crashes and ensure stability.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: Validate T10 PI scatterlist counts When T10 PI is negotiated, vhost-scsi splits protection bytes from the data iterator before mapping the request scatterlists. A malformed request can claim protection bytes that cover or exceed the full payload length. The former leaves no data bytes to map, while the latter underflows exp_data_len before advancing the iterator. Both cases can let a zero data SGL count reach sg_alloc_table_chained(), which triggers BUG_ON(!nents). Reject protection lengths that cover or exceed the payload before subtracting prot_bytes and advancing the iterator. Also propagate negative errors from the protection SGL calculation before calling the allocator, matching the data SGL path.