CyberRota Analysis
AI-GeneratedThe vulnerability affects the vhost-scsi component of the Linux kernel, where improper handling of asynchronous command completions can lead to memory mapping issues. Specifically, if the memory table is replaced while a command is still in-flight, it may result in response data being written to an unrelated userspace object, potentially leading to data corruption or unauthorized access. Organizations using Linux systems that implement vhost-scsi should prioritize applying the relevant patches to mitigate this risk.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOST_SET_MEM_TABLE can replace the memory table while an in-flight command still retains response iovecs translated through the old table. If the old mapping is reused after VHOST_SET_MEM_TABLE returns, command completion can write the response to an unrelated userspace object. Flush the vhost-scsi backend after vhost_dev_ioctl() handles a device ioctl. This waits for in-flight commands that can still use the old response iovecs before the ioctl returns.