Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-38074— vhost-scsi: protect vq->log_used with vq->mutex

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于vq->log_used未受vq->mutex保护，可能导致无效内存写入。

CVSS 8.8 · High EPSS 0.20% · P10

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 057cbf49a1f08297877e46c82f707b1bfea806a8< 80cf68489681c165ded460930e391b1eb37b5f6f affected
057cbf49a1f08297877e46c82f707b1bfea806a8< 8312a1ccff1566f375191a89b9ba71b6eb48a8cd affected
057cbf49a1f08297877e46c82f707b1bfea806a8< 59614c5acf6688f7af3c245d359082c0e9e53117 affected
057cbf49a1f08297877e46c82f707b1bfea806a8< ca85c2d0db5f8309832be45858b960d933c2131c affected
057cbf49a1f08297877e46c82f707b1bfea806a8< bd8c9404e44adb9f6219c09b3409a61ab7ce3427 affected
057cbf49a1f08297877e46c82f707b1bfea806a8< c0039e3afda29be469d29b3013d7f9bdee136834 affected
057cbf49a1f08297877e46c82f707b1bfea806a8< f591cf9fce724e5075cc67488c43c6e39e8cbe27 affected
3.6 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-38074

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
vhost-scsi: protect vq->log_used with vq->mutex
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: protect vq->log_used with vq->mutex The vhost-scsi completion path may access vq->log_base when vq->log_used is already set to false. vhost-thread QEMU-thread vhost_scsi_complete_cmd_work() -> vhost_add_used() -> vhost_add_used_n() if (unlikely(vq->log_used)) QEMU disables vq->log_used via VHOST_SET_VRING_ADDR. mutex_lock(&vq->mutex); vq->log_used = false now! mutex_unlock(&vq->mutex); QEMU gfree(vq->log_base) log_used() -> log_write(vq->log_base) Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be reclaimed via gfree(). As a result, this causes invalid memory writes to QEMU userspace. The control queue path has the same issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于vq->log_used未受vq->mutex保护，可能导致无效内存写入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 057cbf49a1f08297877e46c82f707b1bfea806a8 ~ 80cf68489681c165ded460930e391b1eb37b5f6f -
Linux Linux 3.6 -

II. Public POCs for CVE-2025-38074

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-38074

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-38074 (1)

Same Patch Batch · Linux · 2025-06-18 · 362 CVEs total

CVE-2025-38075 9.8 CRITICAL scsi: target: iscsi: Fix timeout on deleted connection
CVE-2022-50098 8.8 HIGH scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts
CVE-2025-38052 8.8 HIGH net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
CVE-2022-49934 8.8 HIGH wifi: mac80211: Fix UAF in ieee80211_scan_rx()
CVE-2022-50164 8.8 HIGH wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue
CVE-2025-38016 8.8 HIGH HID: bpf: abort dispatch if device destroyed
CVE-2022-49974 8.8 HIGH HID: nintendo: fix rumble worker null pointer deref
CVE-2022-49968 8.0 HIGH ieee802154/adf7242: defer destroy_workqueue call
CVE-2022-49944 7.8 HIGH Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()"
CVE-2022-49952 7.8 HIGH misc: fastrpc: fix memory corruption on probe
CVE-2022-50028 7.8 HIGH gadgetfs: ep_io - wait until IRQ finishes
CVE-2022-49939 7.8 HIGH binder: fix UAF of ref->proc caused by race condition
CVE-2022-49935 7.8 HIGH dma-buf/dma-resv: check if the new fence is really later
CVE-2025-38082 7.8 HIGH gpio: virtuser: fix potential out-of-bound write
CVE-2022-50182 7.8 HIGH media: imx-jpeg: Align upwards buffer size
CVE-2025-38080 7.8 HIGH drm/amd/display: Increase block_sequence array size
CVE-2025-38060 7.8 HIGH bpf: copy_verifier_state() should copy 'loop_entry' field
CVE-2022-50101 7.8 HIGH video: fbdev: vt8623fb: Check the size of screen before memset_io()
CVE-2025-38062 7.8 HIGH genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie
CVE-2025-38064 7.8 HIGH virtio: break and reset virtio devices on device_shutdown()

Showing top 20 of 362 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-38074

No comments yet

Leave a comment