vhost-scsi MemTable Race

Vulnerability analysis

The vhost-scsi subsystem translates guest I/O response descriptors into host-side memory mappings at command submission time, but the SCSI backend completes those commands asynchronously. While commands are still in flight, a device ioctl that updates the guest memory table can swap out the old table, leaving in-flight commands holding response mappings derived from the now-stale table. When such a command finishes, it writes its response through those outdated mappings, corrupting an unrelated host userspace object. The fix adds a backend flush after each device ioctl returns, ensuring all in-flight commands that could still reference the old memory table complete before the ioctl returns to the caller. A malicious guest VM on a host with the vhost-scsi backend enabled can trigger this by issuing SCSI I/O whose completion overlaps a guest memory layout change, and the guest requires no host-side privileges to do so.