CVE - CVE-2025-38074

CVE-ID
CVE-2025-38074	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: protect vq->log_used with vq->mutex The vhost-scsi completion path may access vq->log_base when vq->log_used is already set to false. vhost-thread QEMU-thread vhost_scsi_complete_cmd_work() -> vhost_add_used() -> vhost_add_used_n() if (unlikely(vq->log_used)) QEMU disables vq->log_used via VHOST_SET_VRING_ADDR. mutex_lock(&vq->mutex); vq->log_used = false now! mutex_unlock(&vq->mutex); QEMU gfree(vq->log_base) log_used() -> log_write(vq->log_base) Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be reclaimed via gfree(). As a result, this causes invalid memory writes to QEMU userspace. The control queue path has the same issue.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/bd8c9404e44adb9f6219c09b3409a61ab7ce3427 URL:https://git.kernel.org/stable/c/bd8c9404e44adb9f6219c09b3409a61ab7ce3427 MISC:https://git.kernel.org/stable/c/c0039e3afda29be469d29b3013d7f9bdee136834 URL:https://git.kernel.org/stable/c/c0039e3afda29be469d29b3013d7f9bdee136834 MISC:https://git.kernel.org/stable/c/ca85c2d0db5f8309832be45858b960d933c2131c URL:https://git.kernel.org/stable/c/ca85c2d0db5f8309832be45858b960d933c2131c MISC:https://git.kernel.org/stable/c/f591cf9fce724e5075cc67488c43c6e39e8cbe27 URL:https://git.kernel.org/stable/c/f591cf9fce724e5075cc67488c43c6e39e8cbe27
Assigning CNA
kernel.org
Date Record Created
20250416	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250416)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)