{"id":"CVE-2026-99155","aliases":[],"title":"scsi: xen/scsifront: Check for a NULL shadow entry on a backend response","titleSource":"Linux","descriptionSource":"Linux","products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43","status":"affected","lessThan":"1d91ec793d6c80eca963d426e0da832d40a062df","versionType":"git"},{"version":"6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43","status":"affected","lessThan":"15791e57f57f7050014d08cfe239d4aa1e6b94b0","versionType":"git"},{"version":"6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43","status":"affected","lessThan":"8c8222c255772713eb36cde695777a1fce224917","versionType":"git"}],"defaultStatus":"unaffected","source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-99155"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"5.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.19","versionType":"semver"},{"version":"6.18.59","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.13","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-99155"}],"remediation":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: xen/scsifront: Check for a NULL shadow entry on a backend response\n\nscsifront_do_response() validates the rqid in a backend response against\nVSCSIIF_MAX_REQS before using it to index info->shadow[], but then\ndereferences the entry to test ->inflight without checking that the slot\nis populated.  Shadow slots are NULL before a command is submitted (the\nhost private area is zeroed at allocation) and are reset to NULL in\n_scsifront_put_rqid() once a request completes, so an in-range rqid that\ndoes not correspond to an outstanding request makes the frontend\ndereference a NULL pointer.\n\nA malicious or buggy backend can thus crash the guest by returning a\nresponse whose rqid is in range but not in flight -- for example a\nspurious response before any command has been issued, or a duplicate of\none already completed.  The ring has only VSCSIIF_MAX_REQS (16) slots,\nso before the first command every in-range rqid selects a NULL slot.\n\nReject a response whose shadow slot is not populated.","severity":"unknown","score":null,"published":"2026-10-28T10:35:09.733Z","modified":"2026-10-28T10:35:09.733Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://git.kernel.org/stable/c/1d91ec793d6c80eca963d426e0da832d40a062df","https://git.kernel.org/stable/c/15791e57f57f7050014d08cfe239d4aa1e6b94b0","https://git.kernel.org/stable/c/8c8222c255772713eb36cde695777a1fce224917"],"sources":[{"name":"CVE","id":"CVE-2026-99155","modified":"2026-10-28T10:35:09.733Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-99155"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T02:20:33.012Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}