CVE-2026-93782 vhost-scsi: flush backend after device ioctls
A race condition in the Linux kernel vhost-scsi driver allows guest VMs to corrupt host memory by exploiting stale iovec mappings during memory table updates.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93782?
CVE-2026-93782 is a high-severity vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vhost-scsi: flush backend after device ioctls
vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOST_SET_MEM_TABLE can replace the memory table while an in-flight command still retains response iovecs translated through the old table.
If the old mapping is reused after VHOST_SET_MEM_TABLE returns, command completion can write the response to an unrelated userspace object.
Flush the vhost-scsi backend after vhost_dev_ioctl() handles a device ioctl. This waits for in-flight commands that can still use the old response iovecs before the ioctl returns.
Which versions are affected by CVE-2026-93782?
How do I fix CVE-2026-93782?
Apply the vendor's patch.
Is CVE-2026-93782 being exploited?
There is no known exploitation of CVE-2026-93782 in the wild and no public exploit code.
Sources
Also known as AZL-103694, BELL-CVE-2026-93782, DEBIAN-CVE-2026-93782, GHSA-fqh3-m8p8-gg7r, UBUNTU-CVE-2026-93782.