In the Linux kernel, the iblock_execute_pr_out() function fails to verify that the PREEMPT, PREEMPT_AND_ABORT, and RELEASE operations are supported before invoking the ops->pr_clear callback. When these operations are requested for an iblock device that has not implemented the callback, the NULL check is bypassed, causing a dereference of a NULL function pointer. The resulting kernel panic immediately stops system operation, producing a denial‑of‑service event.

All Linux kernel builds that include the iblock SCSI target module and have not incorporated the fix are affected. No specific version list is supplied, so any kernel prior to the commit that implements the null check is considered vulnerable.

The CVSS score has not been reported, and the EPSS value is unavailable, so the precise risk level cannot be quantified. The vulnerability does not appear in CISA KEV, and no public exploits have been disclosed. Attackers would need to trigger a SCSI PREEMPT or RELEASE operation on an iblock device; thus the attack vector is local to the target device and requires a privileged or authenticated session. The impact of a kernel crash is high, so patching is strongly advised.