The Linux kernel’s vhost‑scsi module accepts a VHOST_SET_FEATURES request to change negotiated virtio feature bits after the vhost‑scsi endpoint has been established. When a feature such as T10‑PI is enabled after the endpoint is active, the module leaves the protection scatterlist table pointer NULL. Subsequent I/O processing then attempts to allocate a scatterlist table with an illegal entry count, triggering a BUG_ON that results in a kernel panic. This flaw does not leak data; it simply brings the entire system down. Affected systems are all Linux kernel releases that include the vhost‑scsi driver prior to the fix referenced in the advisory. The issue is vendor-agnostic because it resides in the core kernel; any distribution that ships the unpatched kernel is vulnerable. Users who employ virtio‑SCSI devices via the vhost interface—such as containers, virtual machines, or userspace tools—are exposed.

Affected systems are all Linux kernel releases that include the vhost‑scsi driver prior to the fix referenced in the advisory. The issue is vendor‑agnostic because it resides in the core kernel; any distribution that ships the unpatched kernel is vulnerable. Users who employ virtio‑SCSI devices via the vhost interface—such as containers, virtual machines, or userspace tools—are exposed.

Risk and exploitability are high because the vulnerability causes a full kernel crash, a denial‑of‑service condition. The CVSS score is 8.8, the EPSS score is < 1%, and the vulnerability is not listed in KEV. An attacker with local privileged access or the ability to control the vhost‑scsi endpoint can easily trigger the failure; the attack requires only a feature‑change request after endpoint creation, a path that is trivially exercised in most vhost‑scsi setups.