The vulnerability arises in the Linux kernel’s scsi target subsystem when it processes iSCSI Persistent Reserve OUT commands during the REGISTER AND MOVE operation. The kernel maps the parameter list into memory, extracts the ISID from the TransportID, then immediately unmaps the buffer before the ISID pointer is used in several comparisons and allocation functions. When the parameter list spans than one page, the mapping is performed via vmap() and the subsequent unmap with vunmap() destroys the virtual address referenced by the ISID pointer, resulting in a use‑after‑free read of freed memory. This can corrupt kernel memory, potentially leading to a crash, data loss, or enabling an attacker to execute arbitrary code with kernel privileges. The weakness corresponds to CWE‑825.

The affected code resides in the core Linux kernel; any distribution that ships an unpatched kernel containing the scsi target implementation is vulnerable. The advisory does not disclose specific kernel versions, so the assumption is that every kernel build prior to the commit that removes the early unmap is at risk until the patch is applied. No product‑specific versions are enumerated, meaning all Linux kernels potentially contain the flaw.

The CVSS score of 9.8 signals critical severity. The EPSS score of < 1 % indicates a low but non‑negligible likelihood that an adversary will attempt exploitation. The flaw is not listed in the CISA KEV catalogue and no public exploits are known. A successful attack would typically require an attacker who can deliver a malicious iSCSI Persistent Reserve OUT command to the target service exposed on TCP 3260; this is a remote attack vector that does not require local privileges. Because the vulnerability causes a kernel memory corruption, exploitation could lead to a denial‑of‑service crash or privilege escalation to root, depending on the environment and defenses.