{"cve":"CVE-2026-99155","nvd":{"published":"2026-10-28T11:17:35.687","modified":"2026-10-28T11:17:35.687","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: xen/scsifront: Check for a NULL shadow entry on a backend response\n\nscsifront_do_response() validates the rqid in a backend response against\nVSCSIIF_MAX_REQS before using it to index info->shadow[], but then\ndereferences the entry to test ->inflight without checking that the slot\nis populated.  Shadow slots are NULL before a command is submitted (the\nhost private area is zeroed at allocation) and are reset to NULL in\n_scsifront_put_rqid() once a request completes, so an in-range rqid that\ndoes not correspond to an outstanding request makes the frontend\ndereference a NULL pointer.\n\nA malicious or buggy backend can thus crash the guest by returning a\nresponse whose rqid is in range but not in flight -- for example a\nspurious response before any command has been issued, or a duplicate of\none already completed.  The ring has only VSCSIIF_MAX_REQS (16) slots,\nso before the first command every in-range rqid selects a NULL slot.\n\nReject a response whose shadow slot is not populated.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/15791e57f57f7050014d08cfe239d4aa1e6b94b0","https://git.kernel.org/stable/c/1d91ec793d6c80eca963d426e0da832d40a062df","https://git.kernel.org/stable/c/8c8222c255772713eb36cde695777a1fce224917"],"products":[],"source":"nvd","synced_at":"2026-10-28T11:37:51.394563875+00:00"},"epss":null,"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}