In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: protect vq->logused with vq->mutex The vhost-scsi completion path may access vq->logbase when vq->logused is already set to false. vhost-thread QEMU-thread vhostscsicompletecmdwork() -> vhostaddused() -> vhostaddusedn() if (unlikely(vq->logused)) QEMU disables vq->logused via VHOSTSETVRINGADDR. mutexlock(&vq->mutex); vq->logused = false now! mutexunlock(&vq->mutex); QEMU gfree(vq->logbase) logused() -> logwrite(vq->logbase) Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be reclaimed via gfree(). As a result, this causes invalid memory writes to QEMU userspace. The control queue path has the same issue.