The vulnerability exists in the Linux kernel’s iSCSI target implementation, where the Text‑phase handler processes Text PDUs. Two bugs were identified: a CRC buffer overread that reads four bytes past the allocated buffer, and a stale pointer double‑free when a DataDigest mismatch occurs with ErrorRecoveryLevel greater than zero. The overread is detected by KASAN on mainline kernels and could lead to memory corruption; the double‑free can trigger a kernel BUG or corrupt the slab freelist on hardened or non‑hardened kernels respectively. Both faults may ultimately cause a kernel crash, memory corruption or potential arbitrary code execution under certain circumstances, as warned by the KASAN messages and double‑free summaries. The CVSS score of 9.8 signals a severe risk at the kernel level.

All Linux kernel packages that incorporate the iSCSI target (LIO) code and have not yet applied the patch commits are affected. The defect appears in all kernels that compile the target code prior to the integration of the commits that fixed the overread and double‑free; no specific pre‑patch version range is supplied, so any kernel with the LIO has the vulnerability until patched.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of less than 1 % suggests that active exploitation at the moment is unlikely, and the vulnerability is not listed in the CISA KEV catalog. However, the exploitation would be carried out remotely by an attacker who can send crafted Text PDUs to an exposed iSCSI target, and no local privilege escalation is required.