{"schema":"threatline.record/2","record":{"id":"CVE-2026-99155","aliases":[],"summary":"scsi: xen/scsifront: Check for a NULL shadow entry on a backend response","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: xen/scsifront: Check for a NULL shadow entry on a backend response\n\nscsifront_do_response() validates the rqid in a backend response against\nVSCSIIF_MAX_REQS before using it to index info->shadow[], but then\ndereferences the entry to test ->inflight without checking that the slot\nis populated.  Shadow slots are NULL before a command is submitted (the\nhost private area is zeroed at allocation) and are reset to NULL in\n_scsifront_put_rqid() once a request completes, so an in-range rqid that\ndoes not correspond to an outstanding request makes the frontend\ndereference a NULL pointer.\n\nA malicious or buggy backend can thus crash the guest by returning a\nresponse whose rqid is in range but not in flight -- for example a\nspurious response before any command has been issued, or a duplicate of\none already completed.  The ring has only VSCSIIF_MAX_REQS (16) slots,\nso before the first command every in-range rqid selects a NULL slot.\n\nReject a response whose shadow slot is not populated.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99155","source_modified_at":"2026-10-28T10:35:09.733Z","fetched_at":"2026-10-28T15:55:58.673066Z","product":"Linux","vendor":"Linux","versions":[{"version":"6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43","lessThan":"1d91ec793d6c80eca963d426e0da832d40a062df","status":"affected","versionType":"git"},{"version":"6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43","lessThan":"15791e57f57f7050014d08cfe239d4aa1e6b94b0","status":"affected","versionType":"git"},{"version":"6d1c2f48f3fcf5f42967938c8ba6b42ac6b44b43","lessThan":"8c8222c255772713eb36cde695777a1fce224917","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99155","source_modified_at":"2026-10-28T10:35:09.733Z","fetched_at":"2026-10-28T15:55:58.673066Z","product":"Linux","vendor":"Linux","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","status":"unaffected","versionType":"semver"},{"version":"6.18.59","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.13","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99155","source_modified_at":"2026-10-28T10:35:09.733Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"name":"Linux","ecosystem":null},"version":"1d91ec793d6c80eca963d426e0da832d40a062df","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99155","source_modified_at":"2026-10-28T10:35:09.733Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"name":"Linux","ecosystem":null},"version":"15791e57f57f7050014d08cfe239d4aa1e6b94b0","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-99155","source_modified_at":"2026-10-28T10:35:09.733Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"name":"Linux","ecosystem":null},"version":"8c8222c255772713eb36cde695777a1fce224917","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T10:35:09.733Z","modified_at":"2026-10-28T10:35:09.733Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-99155","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-28T10:35:09.733Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/1d91ec793d6c80eca963d426e0da832d40a062df"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/15791e57f57f7050014d08cfe239d4aa1e6b94b0"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/8c8222c255772713eb36cde695777a1fce224917"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T10:35:09.733Z","content_hash":"834cf75e2dbcd75592894466e03edf55abead45fb9212c83e95bfa36ee22cfc8"}}