The vulnerability exists in the vhost‑scsi driver of the Linux kernel, where the handling of T10 Protection Information (PI) does not correctly validate the number of protection bytes in a request. An attacker can send a malformed request that either covers all data bytes or underflows the expected data length, resulting in a zero data scatter‑list count being passed to sg_alloc_table_chained(). This triggers a BUG_ON, causing a kernel panic and immediate denial of service. The flaw is identified as an integer sign conversion error categorized under CWE‑191.

All Linux systems running a kernel that includes the vhost‑scsi module and have not applied the patches from commits 2417a498cf3fe64d06faf87e236eda98dd4f04e0, d876c493fc4b811941bfeb4c80beb2dfc4bf025e, or f8fe3f8d342da750dd10361bf66009fd3072926b. Administrators should compare their kernel version against the commit list or upgrade to a release that incorporates these changes.

The CVSS score of 7.1 indicates high severity, and the EPSS score of < 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be a malformed T10 PI packet sent to the vhost‑scsi interface, which could be reachable from a virtual machine or specific virtualization settings; this inference follows from the description, as the explicit vector is not stated in the input. No public exploit is currently available, but the kernel panic it causes renders the system unavailable until a reboot or patch is applied.