A flaw in the Linux kernel’s SCSI target subsystem triggers a use‑after‑free when processing iSCSI Persistent Reserve OUT commands, specifically during the REGISTER AND MOVE operation. The kernel maps the command’s parameter list, extracts the ISID from the transport ID, then unmaps the buffer before the ISID pointer is used in several string comparisons and allocation functions. If the parameter list spans more than one page, the mapping uses vmap() and the subsequent vunmap() invalidates the pointer, leading to an uninitialised read of freed memory and corrupting kernel data structures. The weakness is classified as CWE‑416 (Use‑After‑Free).

This vulnerability exists in the core Linux kernel’s SCSI target implementation; any distribution that ships an unpatched kernel containing that code is affected. Vendor information lists Linux kernels broadly, and no specific kernel releases are enumerated in the advisory. Consequently, all Linux kernel builds preceding the commit that removes the early unmap are at risk until the patch is installed.

The CVSS score of 9.8 signals critical severity. The EPSS score of < 1 % indicates a very low but non‑zero possibility of exploitation. The flaw is not listed in the CISA KEV catalogue, and no public exploits are documented. Based on the description, it is inferred that an attacker can remotely exploit the vulnerability by sending a crafted iSCSI Persistent Reserve OUT command to the target service on TCP 3260. Remote execution of malicious commands in that context can cause a kernel memory corruption, potentially leading to a denial‑of‑service crash.