{"id":"CVE-2026-99155","published":"2026-10-28T11:17:35.687","lastModified":"2026-10-28T11:17:35.687","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: xen/scsifront: Check for a NULL shadow entry on a backend response\n\nscsifront_do_response() validates the rqid in a backend response against\nVSCSIIF_MAX_REQS before using it to index info->shadow[], but then\ndereferences the entry to test ->inflight without checking that the slot\nis populated.  Shadow slots are NULL before a command is submitted (the\nhost private area is zeroed at allocation) and are reset to NULL in\n_scsifront_put_rqid() once a request completes, so an in-range rqid that\ndoes not correspond to an outstanding request makes the frontend\ndereference a NULL pointer.\n\nA malicious or buggy backend can thus crash the guest by returning a\nresponse whose rqid is in range but not in flight -- for example a\nspurious response before any command has been issued, or a duplicate of\none already completed.  The ring has only VSCSIIF_MAX_REQS (16) slots,\nso before the first command every in-range rqid selects a NULL slot.\n\nReject a response whose shadow slot is not populated.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/15791e57f57f7050014d08cfe239d4aa1e6b94b0","tags":[]},{"url":"https://git.kernel.org/stable/c/1d91ec793d6c80eca963d426e0da832d40a062df","tags":[]},{"url":"https://git.kernel.org/stable/c/8c8222c255772713eb36cde695777a1fce224917","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}