The vulnerability arises in the Linux iSCSI target code when iscsit_dec_session_usage_count() calls complete() while still holding sess->session_usage_lock. This timing allows the waiter signaled by complete() to wake up and free the iscsit_session structure before the current thread releases the lock, causing a KASAN slab‑use‑after‑free. The affected code can corrupt kernel memory, potentially compromising system integrity or leading to a denial of service. These issues are represented by CWE‑364 (Synchronization Issue) and CWE‑416 (Use‑After‑Free).

All Linux Kernel builds that contain the non‑patched iSCSI target code are affected, including recent 6.19 release candidates from rc1 through rc6. Systems running earlier or equivalent kernel releases that have not yet incorporated the fix are also vulnerable.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attacks would likely involve manipulating iSCSI sessions, for example by terminating or recreating sessions to trigger the race condition. This inference is drawn from the description of the race involving session release; the exact attack vector is not explicitly documented in the provided data.