A stack buffer overflow occurs when the kernel formats SCSI target LUN paths into a 256‑byte buffer using snprintf(). If an iSCSI WWN name is close to the maximum length of 223 bytes, snprintf() reports a longer output than the buffer can hold. The subsequent memcpy() then reads past the end of the stack buffer, copying adjacent stack contents and exposing private data or triggering a kernel panic when CONFIG_FORTIFY_SOURCE is active. An attacker who can read the vulnerable sysfs entry can provoke this overflow, which can result in a kernel crash or disclosure of internal kernel memory. The weakness is a classic buffer overflow (CWE‑119).

All Linux kernel instances that have not incorporated the fix added by commit 27e06650a5ea. This applies to every distribution shipping a kernel version that lacks the mitigation for the tg_pt_gp_members_show() path. No specific version range was provided, so any kernel prior to the applied commit is considered vulnerable.

The vulnerability is local; it requires the attacker to read the affected sysfs file. While the EPSS score is not available and the issue is not listed in CISA KEV, the safe‑assumption is high risk due to the severity of a buffer overflow that can crash the kernel. The CVSS score is not given, but the description indicates a high likelihood of denial of service. Exploitation requires only low privilege (root or the ability to read sysfs), and the attack vector is inferred to be local read access that triggers a kernel panic.