A stack buffer overflow occurs when the kernel formats SCSI target LUN paths into a 256‑byte buffer using snprintf(). If an iSCSI WWN name is close to the maximum length of 223 bytes, snprintf() reports a longer output than the buffer can hold. The subsequent memcpy() then reads past the end of the stack buffer, copying adjacent stack contents and exposing private data or triggering a kernel panic when CONFIG_FORTIFY_SOURCE is active. An attacker who can read the vulnerable sysfs entry can provoke this overflow, which can result in a kernel crash or disclosure of internal kernel memory. The weakness is a classic buffer overflow and uninitialized value usage (CWE‑120 and CWE‑674).

All Linux kernel instances that have not incorporated the fix added by commit 27e06650a5ea. This applies to every distribution shipping a kernel version that lacks the mitigation for the tg_pt_gp_members_show() path. No specific version range was provided, so any kernel prior to the applied commit is considered vulnerable.

The vulnerability is local; it requires the attacker to read the vulnerable sysfs file. The EPSS score is below 1%, indicating a very low chance of exploitation. The CVSS score is 7.1, making it a high‑severity issue. The lack of an exploit in public reports or KEV listing suggests that exploitation is still of low probability, but the nature of a buffer overflow could cause a kernel crash or leak internal memory. Exploitation requires only low privilege (root or the ability to read sysfs), and the attack vector is inferred to local read access that triggers a kernel panic.