CVE-2026-74702

HIGHPre-NVD 8.88.8—
EchelonGraph scoreHIGH confidence

Score 8.8 from GitHub Security Advisory (severity: HIGH) published 2026-08-22. a secondary CVSS source baseline 8.8; sources differ by 0.0.

Triggered by: GitHub Security Advisory CVSS
Sources: epss, ghsa, secondary
Trending — 4 sources updated this week
8.8EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS: 8.8Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

In the Linux kernel, the following vulnerability has been resolved:

vhost-scsi: reject feature changes after endpoint

vhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates each command's protection scatterlist array (prot_sgl) according to the acknowledged VIRTIO_SCSI_F_T10_PI bit. The command pools are not rebuilt when VHOST_SET_FEATURES changes that bit later.

Although virtio feature bits must not change after feature negotiation, vhost_scsi_set_features() currently accepts such a request after the endpoint is active and updates acked_features. Enabling T10-PI after endpoint setup therefore leaves prot_sgl NULL while the I/O path follows the new feature bit.

For a 129-page protection payload, vhost_scsi_mapal() passes the missing first chunk to sg_alloc_table_chained():

sg_alloc_table_chained(table, 129, first_chunk=NULL, nents_first_chunk=inline_sg_cnt)

sg_pool_index() then hits:

BUG_ON(nents > SG_CHUNK_SIZE); /* 129 > 128 */

The kernel reported the following call trace and register state:

Call Trace: ? __sg_alloc_table+0x1d8/0x250 ? __pfx_vhost_run_work_list+0x10/0x10 [vhost] sg_alloc_table_chained+0x59/0xf0 ? __pfx_sg_pool_alloc+0x10/0x10 ? vhost_scsi_calc_sgls.constprop.0+0x43/0x60 [vhost_scsi] vhost_scsi_handle_vq+0xf02/0x1700 [vhost_scsi] ? __pfx_vhost_scsi_handle_vq+0x10/0x10 [vhost_scsi] vhost_scsi_handle_kick+0x37/0x50 [vhost_scsi] vhost_run_work_list+0x8e/0xd0 [vhost] vhost_task_fn+0xe1/0x210 ret_from_fork+0x348/0x540

RIP: 0010:0x4 CR2 = 0x4 RSP: 0018:ffffc90000dbf940 EFLAGS: 00010202 RAX: ffffffff82396810 RBX: ffff88811dc28b80 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000081

VHOST_F_LOG_ALL is a vhost-specific runtime feature and remains the only exception.

Reject changes to any feature other than VHOST_F_LOG_ALL while the endpoint is active. This preserves the existing runtime log toggle while preventing feature-dependent command resources and data-path state from becoming inconsistent. Userspace must clear the endpoint before changing any other negotiated feature and set the endpoint up again afterward.

CVSS v3
8.8
EG Score
8.8(high)
EG Risk
44(Track)
EG Risk 44/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity88% × 45%
Exploitation0% × 40%
Automatability30% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
0%
EPSS %ILE
3%
KEV
Not listed

Published

August 22, 2026

Last Modified

August 25, 2026

Advisory Details (3)

Auto-updated Aug 25, 2026
No patch confirmed yet.
generic

vhost-scsi: reject feature changes after endpoint - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/42bc45df5905e2b7dccb72adaf7730f66cfbe03f
generic

vhost-scsi: reject feature changes after endpoint - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/9a3eb77a612f9d158e4d27df43677a014e9cfa55
generic

vhost-scsi: reject feature changes after endpoint - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/a06e4611d45518896fbff4f45d9581578b107e91

Vendor Advisories for CVE-2026-74702(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Data Freshness Timeline

(refreshed 25× in last 7d / 28× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-08-30 01:22 UTCEPSS rescore
  2. 2026-08-29 23:05 UTCGHSA enrichment
  3. 2026-08-29 11:53 UTCGHSA enrichment
  4. 2026-08-29 00:39 UTCEG score recompute
  5. 2026-08-29 00:39 UTCGHSA enrichment
  6. 2026-08-28 21:42 UTCEPSS rescore
  7. 2026-08-28 13:05 UTCGHSA enrichment
  8. 2026-08-28 01:52 UTCGHSA enrichment
  9. 2026-08-27 14:41 UTCEG score recompute
  10. 2026-08-27 14:40 UTCGHSA enrichment
  11. 2026-08-27 14:25 UTCEPSS rescore
  12. 2026-08-27 03:24 UTCGHSA enrichment
  13. 2026-08-26 16:13 UTCEG score recompute
  14. 2026-08-26 16:13 UTCGHSA enrichment
  15. 2026-08-26 14:47 UTCEPSS rescore
  16. 2026-08-26 04:52 UTCGHSA enrichment
  17. 2026-08-25 17:41 UTCEG score recompute
  18. 2026-08-25 17:41 UTCGHSA enrichment
  19. 2026-08-25 13:49 UTCEPSS rescore
  20. 2026-08-25 06:29 UTCEG score recompute
  21. 2026-08-25 06:29 UTCGHSA enrichment
  22. 2026-08-25 05:55 UTCEG score recompute▲ 8.80
  23. 2026-08-25 05:55 UTCGHSA enrichment
  24. 2026-08-25 05:55 UTCMITRE cvelistV5CVSS v3 → 8.8 · severity → HIGH
  25. 2026-08-24 14:18 UTCEPSS rescore
Show 3 more
  1. 2026-08-22 16:24 UTCNVD update
  2. 2026-08-22 15:39 UTCEG score recompute
  3. 2026-08-22 15:35 UTCMITRE cvelistV5first tracked

Frequently asked(5)

What is CVE-2026-74702?
CVE-2026-74702 is a high vulnerability published on August 22, 2026. In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhostscsisetupvqcmds() runs from VHOSTSCSISET_ENDPOINT and allocates each command's protection scatterlist array (prot_sgl) according to the acknowledged VIRTIOSCSIFT10PI bit. The…
When was CVE-2026-74702 disclosed?
CVE-2026-74702 was first published in the National Vulnerability Database on August 22, 2026, with the most recent update on August 25, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-74702 actively exploited?
CVE-2026-74702 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 97.3% of all scored CVEs.
What is the CVSS score of CVE-2026-74702?
CVE-2026-74702 has a CVSS v3 base score of 8.8 (NVD).
How do I remediate CVE-2026-74702?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-74702, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-74702

Explore →

Is Your Infrastructure Affected by CVE-2026-74702?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs