CVE-2025-38074

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38074", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.980Z", "datePublished": "2025-06-18T09:33:50.006Z", "dateUpdated": "2026-08-05T11:59:14.881Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:59:14.881Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: protect vq->log_used with vq->mutex\n\nThe vhost-scsi completion path may access vq->log_base when vq->log_used is\nalready set to false.\n\n vhost-thread QEMU-thread\n\nvhost_scsi_complete_cmd_work()\n-> vhost_add_used()\n -> vhost_add_used_n()\n if (unlikely(vq->log_used))\n QEMU disables vq->log_used\n via VHOST_SET_VRING_ADDR.\n mutex_lock(&vq->mutex);\n vq->log_used = false now!\n mutex_unlock(&vq->mutex);\n\n\t\t\t\t QEMU gfree(vq->log_base)\n log_used()\n -> log_write(vq->log_base)\n\nAssuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be\nreclaimed via gfree(). As a result, this causes invalid memory writes to\nQEMU userspace.\n\nThe control queue path has the same issue."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - vhost-scsi is a host-kernel backend driven by a guest VM through its virtqueues and by the VMM through /dev/vhost-scsi ioctls; there is no network-facing path, so the attacker acts from a local context (inside a guest on the host, or a local host process holding the vhost fd).\nAC:L - The attacker controls both sides of the race \u2014 a continuous stream of guest SCSI I/O keeps the unlocked completion worker running, and a guest-initiated virtio device reset forces QEMU's vhost_dev_stop() to clear log_used and free the log bitmap; the window is wide because the entire completion loop ran with no lock at all, and each command issues multiple log_write() calls.\nPR:L - The attacker needs to be an authorized guest tenant driving the virtio-scsi device (or a local host process with the vhost-scsi fd); no host root or elevated host capability is required, and ordinary unprivileged guest I/O suffices to keep the completion path armed.\nUI:N - No victim action is needed \u2014 the guest can itself force the log-teardown path via a virtio device reset or feature renegotiation while completions are in flight, and the migration-end teardown is a routine automated host operation, not a tricked user action.\nS:C - The vulnerable component is the host kernel's vhost-scsi driver, but the corrupted resource is the host VMM (QEMU) userspace address space, reached from inside a guest \u2014 the guest confinement boundary is crossed, matching the guest-to-host escape case.\nC:H - Guest-influenced bit-sets at attacker-chosen offsets from a stale log_base corrupt live QEMU heap objects (pointers, lengths, migration bitmap state), which is leverageable to disclose host memory back into the guest.\nI:H - This is an out-of-bounds/use-after-free write into the host VMM process with attacker-controlled offset and multiplicity, enabling corruption of QEMU control structures and hence control-flow hijack, and it silently corrupts the migration dirty bitmap so migrated guest state is written incorrectly.\nA:H - Corrupting glib heap metadata aborts QEMU and terminates the VM, migrations fail or complete with corrupt state, and set_bit_to_user()'s BUG_ON(r != 1) can be reached when the stale log page is no longer pinnable."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vhost/scsi.c"], "versions": [{"version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "lessThan": "80cf68489681c165ded460930e391b1eb37b5f6f", "status": "affected", "versionType": "git"}, {"version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "lessThan": "8312a1ccff1566f375191a89b9ba71b6eb48a8cd", "status": "affected", "versionType": "git"}, {"version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "lessThan": "59614c5acf6688f7af3c245d359082c0e9e53117", "status": "affected", "versionType": "git"}, {"version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "lessThan": "ca85c2d0db5f8309832be45858b960d933c2131c", "status": "affected", "versionType": "git"}, {"version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "lessThan": "bd8c9404e44adb9f6219c09b3409a61ab7ce3427", "status": "affected", "versionType": "git"}, {"version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "lessThan": "c0039e3afda29be469d29b3013d7f9bdee136834", "status": "affected", "versionType": "git"}, {"version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "lessThan": "f591cf9fce724e5075cc67488c43c6e39e8cbe27", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vhost/scsi.c"], "versions": [{"version": "3.6", "status": "affected"}, {"version": "0", "lessThan": "3.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.240", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.189", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.146", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.93", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.31", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.9", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.10.240"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.15.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.1.146"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.6.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.12.31"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.14.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/80cf68489681c165ded460930e391b1eb37b5f6f"}, {"url": "https://git.kernel.org/stable/c/8312a1ccff1566f375191a89b9ba71b6eb48a8cd"}, {"url": "https://git.kernel.org/stable/c/59614c5acf6688f7af3c245d359082c0e9e53117"}, {"url": "https://git.kernel.org/stable/c/ca85c2d0db5f8309832be45858b960d933c2131c"}, {"url": "https://git.kernel.org/stable/c/bd8c9404e44adb9f6219c09b3409a61ab7ce3427"}, {"url": "https://git.kernel.org/stable/c/c0039e3afda29be469d29b3013d7f9bdee136834"}, {"url": "https://git.kernel.org/stable/c/f591cf9fce724e5075cc67488c43c6e39e8cbe27"}], "title": "vhost-scsi: protect vq->log_used with vq->mutex", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:33:42.169Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/vhost/scsi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "80cf68489681c165ded460930e391b1eb37b5f6f", "status": "affected", "version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "versionType": "git"}, {"lessThan": "8312a1ccff1566f375191a89b9ba71b6eb48a8cd", "status": "affected", "version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "versionType": "git"}, {"lessThan": "59614c5acf6688f7af3c245d359082c0e9e53117", "status": "affected", "version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "versionType": "git"}, {"lessThan": "ca85c2d0db5f8309832be45858b960d933c2131c", "status": "affected", "version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "versionType": "git"}, {"lessThan": "bd8c9404e44adb9f6219c09b3409a61ab7ce3427", "status": "affected", "version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "versionType": "git"}, {"lessThan": "c0039e3afda29be469d29b3013d7f9bdee136834", "status": "affected", "version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "versionType": "git"}, {"lessThan": "f591cf9fce724e5075cc67488c43c6e39e8cbe27", "status": "affected", "version": "057cbf49a1f08297877e46c82f707b1bfea806a8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/vhost/scsi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.6"}, {"lessThan": "3.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.240", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.189", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.146", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.93", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.31", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA282C17-D5E0-4F16-9509-45FAAEFD652E", "versionEndExcluding": "5.10.240", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "3CE0FB9A-DBE8-48B6-BF6E-3C724A4991E3", "versionEndExcluding": "5.15.189", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8DA1166-5C95-475E-BF65-1DF621968E96", "versionEndExcluding": "6.1.146", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "50A4A9DE-24AB-4FB4-AACD-85D8EABB0571", "versionEndExcluding": "6.6.93", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1AE98841-5774-4B45-A81C-2D188DB7E5C3", "versionEndExcluding": "6.12.31", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A9B72DD1-715C-4101-A720-1C8D70044C06", "versionEndExcluding": "6.14.9", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: protect vq->log_used with vq->mutex\n\nThe vhost-scsi completion path may access vq->log_base when vq->log_used is\nalready set to false.\n\n vhost-thread QEMU-thread\n\nvhost_scsi_complete_cmd_work()\n-> vhost_add_used()\n -> vhost_add_used_n()\n if (unlikely(vq->log_used))\n QEMU disables vq->log_used\n via VHOST_SET_VRING_ADDR.\n mutex_lock(&vq->mutex);\n vq->log_used = false now!\n mutex_unlock(&vq->mutex);\n\n\t\t\t\t QEMU gfree(vq->log_base)\n log_used()\n -> log_write(vq->log_base)\n\nAssuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be\nreclaimed via gfree(). As a result, this causes invalid memory writes to\nQEMU userspace.\n\nThe control queue path has the same issue."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vhost-scsi: proteger vq->log_used con vq->mutex La ruta de finalizaci\u00f3n de vhost-scsi puede acceder a vq->log_base cuando vq->log_used ya est\u00e1 configurado como falso. vhost-thread QEMU-thread vhost_scsi_complete_cmd_work() -> vhost_add_used() -> vhost_add_used_n() if (unlikely(vq->log_used)) QEMU deshabilita vq->log_used mediante VHOST_SET_VRING_ADDR. mutex_lock(&vq->mutex); vq->log_used = false now! mutex_unlock(&vq->mutex); QEMU gfree(vq->log_base) log_used() -> log_write(vq->log_base) Suponiendo que el VMM es QEMU. La ruta vq->log_base proviene del espacio de usuario de QEMU y se puede recuperar mediante gfree(). Como resultado, esto provoca escrituras de memoria no v\u00e1lidas en el espacio de usuario de QEMU. La ruta de la cola de control presenta el mismo problema."}], "id": "CVE-2025-38074", "lastModified": "2026-07-30T06:22:48.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-06-18T10:15:40.850", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/59614c5acf6688f7af3c245d359082c0e9e53117"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/80cf68489681c165ded460930e391b1eb37b5f6f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8312a1ccff1566f375191a89b9ba71b6eb48a8cd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bd8c9404e44adb9f6219c09b3409a61ab7ce3427"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c0039e3afda29be469d29b3013d7f9bdee136834"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ca85c2d0db5f8309832be45858b960d933c2131c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f591cf9fce724e5075cc67488c43c6e39e8cbe27"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: vhost-scsi: protect vq->log_used with vq->mutex", "id": "2373357", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373357"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvhost-scsi: protect vq->log_used with vq->mutex\nThe vhost-scsi completion path may access vq->log_base when vq->log_used is\nalready set to false.\nvhost-thread QEMU-thread\nvhost_scsi_complete_cmd_work()\n-> vhost_add_used()\n-> vhost_add_used_n()\nif (unlikely(vq->log_used))\nQEMU disables vq->log_used\nvia VHOST_SET_VRING_ADDR.\nmutex_lock(&vq->mutex);\nvq->log_used = false now!\nmutex_unlock(&vq->mutex);\nQEMU gfree(vq->log_base)\nlog_used()\n-> log_write(vq->log_base)\nAssuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be\nreclaimed via gfree(). As a result, this causes invalid memory writes to\nQEMU userspace.\nThe control queue path has the same issue."], "name": "CVE-2025-38074", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-06-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38074\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38074\nhttps://lore.kernel.org/linux-cve-announce/2025061839-CVE-2025-38074-dc14@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-06-23T08:53:47.808480+00:00", "updated": "2025-06-23T08:53:47.808527+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}