In the Linux kernel, the SCSI target code for handling PR‑OUT TransportIDs incorrectly passes an unbounded buffer to a string search function without restricting the search length. An attacker who can send a malformed TransportID whose name lacks the expected terminator can cause the kernel to read past the provided data, reaching a guard page and triggering a kernel oops. This over‑read leads to a denial of service by crashing the system. The weakness is an out‑of‑bounds read and improper string handling as described by the kernel code. No privilege escalation or arbitrary code execution is disclosed by the current fix.

All Linux kernel builds that include the SCSI target implementation and support iSCSI TPGs may be affected. The change applies to any version before the commit that introduced the bound‑check fix; specific version information is not available from the provided data.

The vulnerability can be exploited by any initiator that can issue a PR‑OUT command to a target that exposes a SCSI over IP interface. The absence of an authentication limitation in the description suggests that any authorized initiator can trigger the flaw. The high CVSS score of 9.8 indicates a critical severity, meaning that exploitation would have a devastating impact, primarily a denial of service. The EPSS score indicates a very low but non‑zero likelihood of exploitation (<1%) and the flaw is not listed in the CISA KEV catalog. This suggests that while exploitation evidence may be limited, the vulnerability remains a significant risk due to its ease of exploitation and catastrophic effect.