The vulnerability arises in the Linux kernel vhost-scsi driver when processing SCSI commands that include T10 Protection Information (PI). The code responsible for segregating protection bytes from the data iterator incorrectly validates the number of protection bytes, allowing a malformed request to either cover all data bytes or underflow the expected data length. This leads to a zero data scatter‑list count being passed to sg_alloc_table_chained(), which then triggers a BUG_ON, causing the kernel to crash. The resulting crash constitutes a denial‑of‑service on the affected host. This flaw impacts all Linux kernel builds that contain the vhost-scsi module without the defensive patches referenced in the advisory. The commit hashes provided in the references show where the validation logic was added; any kernel lacking those changes is vulnerable. No specific kernel version is named, meaning that all systems running pre‑patch kernels that expose vhost‑scsi to SCSI commands are at risk. The exploitation risk is high because a single crafted SCSI command can terminate the kernel, halting the entire host or virtual machine. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of public exploitation does not diminish the severity. A likely attack vector is an attacker with access to the virtual SCSI interface, possibly a VM resident or, depending on configuration, a remote attacker bound to the host’s virt‑io subsystem.

All Linux systems that run a kernel with the vhost-scsi module and have not applied the patches associated with commit 2417a498cf3fe64d06faf87e236eda98dd4f04e0, d876c493fc4b811941bfeb4c80beb2dfc4bf025e, or f8fe3f8d342da750dd10361bf66009fd3072926b. Administrators should consult the changelog for their current kernel or update to a release that includes these commits.

The vulnerability can be triggered by sending a malformed T10 PI packet to the vhost-scsi interface, which may be accessible from a virtual machine or in certain virtualization setups remotely. No public exploit is known, but the protection failure leads to an immediate kernel panic, resulting in total downtime. Given the severity of a kernel crash and the absence of mitigation in the CISA KEV catalog, a prompt update is strongly recommended.