The vulnerability arises when an iSER initiator sends a login PDU that is shorter than the required 76 bytes. The kernel subtracts the header length from the reported byte count without a lower bound, producing a negative value that is subsequently used as the length for a memcpy operation. Because the length is sign-extended to a size_t, the operation attempts to copy several gigabytes into an 8192‑byte buffer, causing a memory corruption that results in a crash of the node. The flaw is exploited during the login phase, before any authentication, so no credentials are required path. The impact is a loss of availability; the node becomes unresponsive after a single malicious request.

This flaw affects all Linux kernel releases that include the iSER (IB/ISERT) driver without the recent patch. The vendor is Linux, and any distribution that ships the kernel with this driver is potentially exposed unless the kernel has been updated beyond the point where login PDUs shorter than ISER_HEADERS_LEN are rejected. Exact supplied, so all modern kernels that support iSCSI over RDMA are considered affected.

The CVSS score is 9.8, but the EPSS score of <1% indicates a very low exploitation probability. Nevertheless, the practical availability of the flaw is high: no authentication is required, the exploit is a simple crafted PDU, and the attack can be performed from any remote iSER session. The vulnerability is not listed in CISA’s KEV catalog, but that does not diminish the likelihood of exploitation in environments that expose the iSCSI port. Because the flaw leads directly to a crash, the operational impact is a full denial of service, making it a high‑severity issue for any system that relies on the iSER driver.