The vulnerability resides in the Linux kernel's libiscsi module, where the handling of SCSI response data allowed the kernel to read past the end of the supplied data segment (CWE‑125). The code incorrectly validated the data length, which let a malicious iSCSI target supply a response whose length matched the sense length. This caused the kernel to copy two additional unused bytes from the connection buffer into the command’s sense buffer, exposing stale kernel memory contents to user‑space processes that queried the sense buffer. The result is a small but actionable information disclosure, potentially revealing recent kernel traffic or memory contents that could aid further exploitation.

The flaw affects all Linux kernel implementations that include the libiscsi component and have not applied the fix commit. It is present in every distribution kernel version up to and including the stable branch prior to the patch 1f07a897d43c63e6c9458bf77450defef39b5833. The fix is available in the stable tree as of the referenced commit.

The CVSS score is 7.5, the EPSS score is less than 1%, and it is not listed in CISA KEV catalog. Exploitation requires an attacker who can control an iSCSI target to send a crafted SCSI response with a length matching the sense length. The attacker would then cause the kernel to copy two stale bytes into the sense buffer, which is then returned to user‑space. The attack vector is network‑based and requires the victim to have an iSCSI target configured. While the disclosed information is limited, it can provide kernel data that may be useful for more advanced exploits. The overall risk is moderate to high for environments that expose iSCSI services to untrusted hosts.