{"id":"CVE-2026-99155","revision":"ae6db2e7247742d38eaa9a31be6c55f3","records":[{"revision":"ae6db2e7247742d38eaa9a31be6c55f3","observedAt":"2026-10-30T13:45:33.454+00:00","statement":{"source":"cve-program","id":"CVE-2026-99155","aliases":[],"title":"scsi: xen/scsifront: Check for a NULL shadow entry on a backend response","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: xen/scsifront: Check for a NULL shadow entry on a backend response\n\nscsifront_do_response() validates the rqid in a backend response against\nVSCSIIF_MAX_REQS before using it to index info->shadow[], but then\ndereferences the entry to test ->inflight without checking that the slot\nis populated.  Shadow slots are NULL before a command is submitted (the\nhost private area is zeroed at allocation) and are reset to NULL in\n_scsifront_put_rqid() once a request completes, so an in-range rqid that\ndoes not correspond to an outstanding request makes the frontend\ndereference a NULL pointer.\n\nA malicious or buggy backend can thus crash the guest by returning a\nresponse whose rqid is in range but not in flight -- for example a\nspurious response before any command has been issued, or a duplicate of\none already completed.  The ring has only VSCSIIF_MAX_REQS (16) slots,\nso before the first command every in-range rqid selects a NULL slot.\n\nReject a response whose shadow slot is not populated.","state":0,"publishedAt":"2026-10-28T10:35:09.733+00:00","modifiedAt":"2026-10-30T12:42:21.472+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/xen-scsifront.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43\",\n                            \"lessThan\": \"448b9a8b530b753d346dab10add09a502fc719a4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43\",\n                            \"lessThan\": \"e397d4da76bed72db6ac4a0848fb6217f8394dca\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43\",\n                            \"lessThan\": \"90186a2354821329a27d92b266c0f05e8f4f637c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43\",\n                            \"lessThan\": \"1d91ec793d6c80eca963d426e0da832d40a062df\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43\",\n                            \"lessThan\": \"15791e57f57f7050014d08cfe239d4aa1e6b94b0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43\",\n                            \"lessThan\": \"8c8222c255772713eb36cde695777a1fce224917\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/xen-scsifront.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.19\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.19\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.191\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.161\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.115\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.59\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.13\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/448b9a8b530b753d346dab10add09a502fc719a4","https://git.kernel.org/stable/c/e397d4da76bed72db6ac4a0848fb6217f8394dca","https://git.kernel.org/stable/c/90186a2354821329a27d92b266c0f05e8f4f637c","https://git.kernel.org/stable/c/1d91ec793d6c80eca963d426e0da832d40a062df","https://git.kernel.org/stable/c/15791e57f57f7050014d08cfe239d4aa1e6b94b0","https://git.kernel.org/stable/c/8c8222c255772713eb36cde695777a1fce224917"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99155","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99155","identifiers":["CVE-2026-99155"]},"retained":false,"historicalAffected":[]}],"coverage":[]}