A use‑after‑free error exists in the Linux kernel’s iSCSI target module. The bug arises when the connection usage counter is decreased and the completion callback is executed while still holding the conn_usage_lock. The callback may wake a waiter that frees the iSCSI connection structure before the lock is released, leading the kernel to attempt to unlock a deallocated object. This triggers a KASAN slab‑use‑after‑free notification and results in a kernel crash.

Linux kernel builds that include the iSCSI target module from the 6.19 release candidates 6.19‑rc1 through rc6 are affected. The vulnerability is present in the generic kernel package and is relevant to any distribution that ships those versions without the patch.

The CVSS score of 7.8 classifies the flaw as high severity, while the EPSS score of less than 1 % indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no confirmed attacks. The iSCSI target interface can be reached over the network, so an attacker with the ability to send iSCSI commands may trigger the use‑after‑free and cause a kernel panic. No evidence suggests that the flaw can be leveraged for remote code execution; the primary risk is loss of service.