CVE-2026-99155

A flaw was found in the Linux kernel's Xen virtual Small Computer System Interface (SCSI) frontend driver. This vulnerability allows a malicious or compromised backend service to trigger a Denial of Service (DoS) by crashing the guest virtual machine. The issue occurs when the driver processes a storage response referencing an inactive request identifier, causing the system to dereference an unpopulated pointer due to missing validation.

This vulnerability is classified as having Moderate severity because exploitation requires elevated host privileges or a compromised Xen backend domain, restricting exposure exclusively to Xen-virtualized guests using virtual SCSI devices. In standard Red Hat Enterprise Linux environments, virtualization primarily utilizes KVM with virtio storage rather than Xen paravirtualized SCSI drivers. Furthermore, triggering the unpopulated pointer dereference results only in a guest denial of service without permitting arbitrary code execution or data leakage.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.