CVE-2025-38074
Estado: ModificadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
vhost-scsi: protect vq->log_used with vq->mutex
The vhost-scsi completion path may access vq->log_base when vq->log_used is already set to false.
Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be reclaimed via gfree(). As a result, this causes invalid memory writes to QEMU userspace.
The control queue path has the same issue.
Detalles técnicos trazas, registros y código del informe original
vhost-thread QEMU-thread
vhost_scsi_complete_cmd_work()
-> vhost_add_used()
-> vhost_add_used_n()
if (unlikely(vq->log_used))
QEMU disables vq->log_used
via VHOST_SET_VRING_ADDR.
mutex_lock(&vq->mutex);
vq->log_used = false now!
mutex_unlock(&vq->mutex);
QEMU gfree(vq->log_base)
log_used()
-> log_write(vq->log_base)CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.20%
- Percentil entre todas las CVEs puntuadas: 9
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- NVD-CWE-noinfo
Referencias
- https://git.kernel.org/stable/c/59614c5acf6688f7af3c245d359082c0e9e53117
- https://git.kernel.org/stable/c/80cf68489681c165ded460930e391b1eb37b5f6f
- https://git.kernel.org/stable/c/8312a1ccff1566f375191a89b9ba71b6eb48a8cd
- https://git.kernel.org/stable/c/bd8c9404e44adb9f6219c09b3409a61ab7ce3427
- https://git.kernel.org/stable/c/c0039e3afda29be469d29b3013d7f9bdee136834
- https://git.kernel.org/stable/c/ca85c2d0db5f8309832be45858b960d933c2131c
- https://git.kernel.org/stable/c/f591cf9fce724e5075cc67488c43c6e39e8cbe27
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-38074",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 6,
"exploitabilityScore": 2
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
"lessThan": "80cf68489681c165ded460930e391b1eb37b5f6f",
"versionType": "git"
},
{
"status": "affected",
"version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
"lessThan": "8312a1ccff1566f375191a89b9ba71b6eb48a8cd",
"versionType": "git"
},
{
"status": "affected",
"version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
"lessThan": "59614c5acf6688f7af3c245d359082c0e9e53117",
"versionType": "git"
},
{
"status": "affected",
"version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
"lessThan": "ca85c2d0db5f8309832be45858b960d933c2131c",
"versionType": "git"
},
{
"status": "affected",
"version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
"lessThan": "bd8c9404e44adb9f6219c09b3409a61ab7ce3427",
"versionType": "git"
},
{
"status": "affected",
"version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
"lessThan": "c0039e3afda29be469d29b3013d7f9bdee136834",
"versionType": "git"
},
{
"status": "affected",
"version": "057cbf49a1f08297877e46c82f707b1bfea806a8",
"lessThan": "f591cf9fce724e5075cc67488c43c6e39e8cbe27",
"versionType": "git"
}
],
"programFiles": [
"drivers/vhost/scsi.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.240",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.189",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.146",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.93",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.31",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.14.9",
"versionType": "semver",
"lessThanOrEqual": "6.14.*"
},
{
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/vhost/scsi.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-06-18T10:15:40.850",
"references": [
{
"url": "https://git.kernel.org/stable/c/59614c5acf6688f7af3c245d359082c0e9e53117",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/80cf68489681c165ded460930e391b1eb37b5f6f",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8312a1ccff1566f375191a89b9ba71b6eb48a8cd",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bd8c9404e44adb9f6219c09b3409a61ab7ce3427",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c0039e3afda29be469d29b3013d7f9bdee136834",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ca85c2d0db5f8309832be45858b960d933c2131c",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f591cf9fce724e5075cc67488c43c6e39e8cbe27",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: protect vq->log_used with vq->mutex\n\nThe vhost-scsi completion path may access vq->log_base when vq->log_used is\nalready set to false.\n\n vhost-thread QEMU-thread\n\nvhost_scsi_complete_cmd_work()\n-> vhost_add_used()\n -> vhost_add_used_n()\n if (unlikely(vq->log_used))\n QEMU disables vq->log_used\n via VHOST_SET_VRING_ADDR.\n mutex_lock(&vq->mutex);\n vq->log_used = false now!\n mutex_unlock(&vq->mutex);\n\n\t\t\t\t QEMU gfree(vq->log_base)\n log_used()\n -> log_write(vq->log_base)\n\nAssuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be\nreclaimed via gfree(). As a result, this causes invalid memory writes to\nQEMU userspace.\n\nThe control queue path has the same issue."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vhost-scsi: proteger vq->log_used con vq->mutex La ruta de finalización de vhost-scsi puede acceder a vq->log_base cuando vq->log_used ya está configurado como falso. vhost-thread QEMU-thread vhost_scsi_complete_cmd_work() -> vhost_add_used() -> vhost_add_used_n() if (unlikely(vq->log_used)) QEMU deshabilita vq->log_used mediante VHOST_SET_VRING_ADDR. mutex_lock(&vq->mutex); vq->log_used = false now! mutex_unlock(&vq->mutex); QEMU gfree(vq->log_base) log_used() -> log_write(vq->log_base) Suponiendo que el VMM es QEMU. La ruta vq->log_base proviene del espacio de usuario de QEMU y se puede recuperar mediante gfree(). Como resultado, esto provoca escrituras de memoria no válidas en el espacio de usuario de QEMU. La ruta de la cola de control presenta el mismo problema."
}
],
"lastModified": "2026-07-30T06:22:48.127",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AA282C17-D5E0-4F16-9509-45FAAEFD652E",
"versionEndExcluding": "5.10.240"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3CE0FB9A-DBE8-48B6-BF6E-3C724A4991E3",
"versionEndExcluding": "5.15.189",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8DA1166-5C95-475E-BF65-1DF621968E96",
"versionEndExcluding": "6.1.146",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "50A4A9DE-24AB-4FB4-AACD-85D8EABB0571",
"versionEndExcluding": "6.6.93",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1AE98841-5774-4B45-A81C-2D188DB7E5C3",
"versionEndExcluding": "6.12.31",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A9B72DD1-715C-4101-A720-1C8D70044C06",
"versionEndExcluding": "6.14.9",
"versionStartIncluding": "6.13"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}