The Linux kernel SCSI target subsystem contains a defect where the target_core_file module does not initialize the aio_cmd->iocb ki_write_stream field when handling a write command. The uninitialized field can mistakenly indicate a write stream count that exceeds the maximum, causing the kernel to return a failure status for the operation. This flaw, classified as CWE-824, may lead to data loss or operation failure for services that depend on correct write completion behavior. No direct path for code execution or privilege escalation is disclosed by the description, but the impact on data integrity and service availability is significant if the error propagates to user‑level processes.

All Linux kernel releases that include the target_core_file module prior to the commit adding kzalloc_flex allocation and explicit ki_write_stream initialization are potentially vulnerable. Because no specific version numbers are listed, any unpatched kernel version that still uses the old allocation logic should be considered at risk.

The CVSS score of 7.5 indicates a high severity kernel‑space flaw, but the EPSS score of <1% suggests that active exploitation is not currently documented. The likely attack vector is local or privileged execution that can submit write requests through the SCSI target interface, as the flaw is triggered by fd_execute_rw_aio(). Based on the description, it is inferred that remote exploitation without accessing the target device is not feasible. The vulnerability is not listed in CISA KEV catalog.