Linux Kernel Vulnerability in vhost-scsi of QEMU

CVE-2025-38074

What is CVE-2025-38074?

A vulnerability in the vhost-scsi subsystem of the Linux kernel allows access to the vq->log_base when vq->log_used is improperly managed. This can result in invalid memory writes to QEMU userspace due to improper synchronization mechanisms. The issue arises when configurations from QEMU disable vq->log_used while the completion path attempts to log memory operations. Such a flaw can be exploited when the control queue path handles vq->log_base, permitting attackers to potentially corrupt memory and lead to system instability. Systems running QEMU should be updated to the latest version to mitigate this risk.

References