In the Linux kernel, the libiscsi_tcp implementation contains a path that copies SCSI command response data into a fixed 8192‑byte buffer without enforcing an upper bound on the data length. A malicious iSCSI target that sends a SCSI Response PDU with a DataSegmentLength between 8193 and the negotiated MaxRecvDataSegmentLength can cause an overflow of this buffer, leading to kernel memory corruption. This flaw is a classic buffer overflow in kernel space and could potentially allow an attacker to influence kernel execution, though the specific outcome is not described in the advisory. The vulnerability is identified as a failure to bound‑check input data in the kernel data reception logic.

All Linux kernel builds that include the libiscsi_tcp module are affected. Systems running any Linux kernel variant that loads this module and engages in iSCSI exchanges are vulnerable. The flaw exists across all kernel versions prior to the commit that introduced the boundary check.

The CVSS score of 9.8 indicates critical severity. The EPSS score is < 1%, and the CVE is not listed in the CISA KEV catalog. Consequently, the public exploitation likelihood cannot be quantified from the available data. Exploitation requires an attacker to supply a crafted iSCSI SCSI Response PDU with an oversized DataSegmentLength over the network to a vulnerable Linux system. The lack of publicly known exploits and the absence of a KEV listing suggest that risk is uncertain but the potential for kernel compromise exists due to the nature of the defect.