In the Linux kernel, the vhost‑scsi subsystem maps guest response descriptors into userspace iovecs. When the VHOST_SET_MEM_TABLE ioctl replaces the memory table while a SCSI command is still pending, the completion routine can write its response to an unrelated userspace object that was mapped by a different guest. This flaw is a classic use‑after‑free/pointer‑reuse condition that can corrupt kernel memory and potentially expose sensitive data to an attacker with the ability to issue the ioctl.

Any Linux system that runs a kernel containing the vhost‑scsi module and has not yet incorporated the backend‑flush patch is affected. The vulnerability applies across all mainstream distributions because the module is part of the standard kernel tree and is often enabled by default. No explicit version bounds are given, so all kernel releases prior to the patch are vulnerable.

The CVSS score of 7.8 indicates significant severity, while an EPSS score of less than 1% suggests a very low but nonzero chance of real‑world exploitation. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires the ability to execute the VHOST_SET_MEM_TABLE ioctl, which typically requires privileged access or a privileged virtual machine, meaning an attacker must already have elevated rights to trigger the bug.