Critical Memory Access Vulnerability in Linux Kernel (CVE-2025-38074)
Summary
CVE-2025-38074: In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: protect vq->log_used with vq->mutex The vhost-scsi completion path may access vq->log_base when vq->log_used is already set to false. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages hardware resources and provides essential services for software applications. The kernel's stability and security are paramount, as vulnerabilities can lead to severe system compromises. This specific vulnerability affects the vhost-scsi component, which is responsible for handling SCSI commands in virtualized environments, particularly when using QEMU as the Virtual Machine Monitor (VMM).
Vulnerability Detail
CVE-2025-38074 is a vulnerability in the Linux kernel's vhost-scsi component. It arises from improper synchronization between threads, leading to a situation where the completion path can access a memory region that has already been freed. Specifically, when the QEMU thread disables the log_used flag, the vhost-scsi completion path may still attempt to write to the log_base memory, resulting in invalid memory writes. This can lead to potential data corruption, crashes, or exploitation by an attacker to execute arbitrary code in the QEMU userspace.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
CVE-2025-38074 is a critical vulnerability in the Linux kernel that affects the vhost-scsi component, posing significant risks to systems using QEMU. It is essential to apply the necessary updates to protect your system from potential exploitation. Regular monitoring and timely updates are key to maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38074 is a vulnerability in the Linux kernel affecting the vhost-scsi component, which can lead to invalid memory writes in the QEMU userspace.
This vulnerability can cause data corruption, crashes, or allow an attacker to execute arbitrary code in the QEMU userspace, potentially compromising your system.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply providing a manifest file like package-lock.json, you can check for vulnerabilities without needing to install additional software.
While there are no specific workarounds available, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Detailed information about CVE-2025-38074 can be found in the official CVE database and security advisories from the Linux kernel maintainers.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
