In the Linux kernel, an unchecked NULL pointer dereference can occur in the scsi xen/scsifront driver when a backend sends a response with an in‑range request ID that is not actually in flight. The driver validates the request ID against the maximum, but does not confirm that the corresponding shadow slot is populated before accessing the slot’s ‘inflight’ flag. A NULL entry leads to a kernel crash, which in a guest OS results in a denial of service for that guest. This flaw can be triggered by a malicious or buggy backend that returns spurious, duplicate, or out‑of‑sequence responses. The likely attack vector is a compromised or misbehaving backend interface, either through a malicious pod that controls the backend or by software errors that produce bad responses. The exploit does not require local privilege escalation on the guest; the vulnerability is triggered by the backend response, so control over the backend or the ability to inject such responses presents the primary condition for exploitation. The impact is an untrusted backend causing a forced crash of the front end, effectively rendering the guest or the entire host session unstable. Because the ring has only 16 slots, during system startup or prior to any legitimate I/O initialisation, any in‑range request ID is most likely NULL, making the flaw possibly exploitable at boot or during early operation.

This issue affects Linux kernel releases that compile the xen scsi front‑end code; the excerpt is from the Linux kernel source itself. No specific kernel version range is given, but all builds that include the scsi xen/scsifront driver are potentially impacted unless the patch was applied upstream.

No EPSS score is available for this vulnerability, and it is not listed in CISA’s KEV catalog, suggesting limited public exploitation activity to date. Nonetheless, the flaw carries a high severity because it leads to a crash without privilege escalation or user interaction. The exploit would require an adversary who can send crafted responses to the xen scsi front end, which is typically limited to trusted hypervisor components. Therefore, the practical threat level is moderate to high for environments where the backend and frontend separation is not strictly enforced or where the virtualization layer may be compromised.