{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-74702 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-74702 is a high-severity vulnerability in Linux, published on 22 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-74702 and fix it if it is affected.\n\nWhat it is: CVE-2026-74702 is a high-severity vulnerability in Linux, published on 22 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-74702 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-74702/ (Markdown: https://insights.sbomify.com/CVE-2026-74702/index.md)","id":"CVE-2026-74702","markdown":"https://insights.sbomify.com/CVE-2026-74702/index.md","name":"CVE-2026-74702","record":{"aliases":["BELL-CVE-2026-74702","DEBIAN-CVE-2026-74702","GHSA-r9hq-6x72-7q3j","UBUNTU-CVE-2026-74702"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel vhost-scsi","requires_auth":"low_privilege","summary":"A local attacker can trigger a kernel crash in vhost-scsi by changing virtio features after endpoint setup, causing a null pointer dereference.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: reject feature changes after endpoint\n\nvhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates\neach command's protection scatterlist array (prot_sgl) according to the\nacknowledged VIRTIO_SCSI_F_T10_PI bit.  The command pools are not rebuilt\nwhen VHOST_SET_FEATURES changes that bit later.\n\nAlthough virtio feature bits must not change after feature negotiation,\nvhost_scsi_set_features() currently accepts such a request after the\nendpoint is active and updates acked_features.  Enabling T10-PI after\nendpoint setup therefore leaves prot_sgl NULL while the I/O path follows\nthe new feature bit.\n\nFor a 129-page protection payload, vhost_scsi_mapal() passes the missing\nfirst chunk to sg_alloc_table_chained():\n\n  sg_alloc_table_chained(table, 129, first_chunk=NULL,\n                         nents_first_chunk=inline_sg_cnt)\n\nsg_pool_index() then hits:\n\n  BUG_ON(nents \u003e SG_CHUNK_SIZE);   /* 129 \u003e 128 */\n\nThe kernel reported the following call trace and register state:\n\n  Call Trace:\n   \u003cTASK\u003e\n   ? __sg_alloc_table+0x1d8/0x250\n   ? __pfx_vhost_run_work_list+0x10/0x10 [vhost]\n   sg_alloc_table_chained+0x59/0xf0\n   ? __pfx_sg_pool_alloc+0x10/0x10\n   ? vhost_scsi_calc_sgls.constprop.0+0x43/0x60 [vhost_scsi]\n   vhost_scsi_handle_vq+0xf02/0x1700 [vhost_scsi]\n   ? __pfx_vhost_scsi_handle_vq+0x10/0x10 [vhost_scsi]\n   vhost_scsi_handle_kick+0x37/0x50 [vhost_scsi]\n   vhost_run_work_list+0x8e/0xd0 [vhost]\n   vhost_task_fn+0xe1/0x210\n   ret_from_fork+0x348/0x540\n   \u003c/TASK\u003e\n\n  RIP: 0010:0x4\n  CR2 = 0x4\n  RSP: 0018:ffffc90000dbf940 EFLAGS: 00010202\n  RAX: ffffffff82396810 RBX: ffff88811dc28b80 RCX: 0000000000000000\n  RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000081\n\nVHOST_F_LOG_ALL is a vhost-specific runtime feature and remains the only\nexception.\n\nReject changes to any feature other than VHOST_F_LOG_ALL while the\nendpoint is active.  This preserves the existing runtime log toggle while\npreventing feature-dependent command resources and data-path state from\nbecoming inconsistent.  Userspace must clear the endpoint before changing\nany other negotiated feature and set the endpoint up again afterward.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"vhost-scsi: reject feature changes after endpoint","id":"CVE-2026-74702","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"vhost-scsi: Validate T10 PI scatterlist counts","id":"CVE-2026-74703"},"packages":[],"prev":{"headline":"net/openvswitch: check Ethernet header length in key_extract()","id":"CVE-2026-74701"},"products":["Linux"],"published":"2026-08-22","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-25","vendors":["Linux"]},"summary":"A local attacker can trigger a kernel crash in vhost-scsi by changing virtio features after endpoint setup, causing a null pointer dereference.","url":"https://insights.sbomify.com/CVE-2026-74702/"}