CVE-2026-74702

A flaw was found in the vhost-scsi component of the Linux kernel. This vulnerability allows a local attacker to cause a denial of service (DoS) by changing virtio feature bits after the vhost-scsi endpoint has been activated. Specifically, enabling the T10-PI feature after setup can lead to an inconsistent state where a null pointer is dereferenced during I/O operations, resulting in a kernel crash.

This flaw is assessed as having a Moderate impact because exploitation is constrained to a local denial of service, requiring privileged access to initialize and manipulate vhost device endpoints. An attacker cannot exploit this vulnerability to compromise host confidentiality or integrity. Supported Red Hat Enterprise Linux releases are not affected as the vulnerable code is not present in their shipping kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.