The vulnerability resides in the iSCSI target implementation of the Linux kernel. It occurs when a CHAP_R response is processed: the kernel allocates a digest buffer sized for the expected SHA‑256 or MD5 hash, then decodes the Base64‑encoded response into that buffer without verifying that the decoded size fits. Because up to 127 Base64 characters can produce 95 decoded bytes, the write overruns the allocated buffer by 63 bytes for SHA‑256 or 79 bytes for MD5, corrupting kernel memory. This buffer overflow can be leveraged to execute arbitrary code with kernel privileges, resulting in a remote code execution vector.

Every Linux kernel build that includes the iSCSI target module is at risk if the patch adding a length check before Base64 decoding has not been applied. Distributions shipping the default kernel with an iSCSI target enabled and still using the pre‑patch code path are vulnerable. The issue exists in any kernel version that does not contain the specific commit introducing the validation logic.

The CVSS score of 9.8 indicates critical severity. The EPSS is below 1 %, indicating low current exploitation activity, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be able to deliver a specially crafted CHAP_R value to a target configured for CHAP authentication; only network reachability to the iSCSI target is required. If successful, the overflow allows control of kernel execution flow, enabling arbitrary code execution with elevated privileges.