A use‑after‑free condition has been identified in the Linux kernel’s iSCSI/iSER (iSCSI Extension for RDMA) subsystem. During the teardown of a connection, deferred control PDU completions may run against a connection object that has already been freed, allowing an attacker to corrupt kernel memory and execute arbitrary code with privileged kernel access. The vulnerability is triggered by a race between the release work item and the completion processing for control PDUs, leading to potential exploitation of kernel memory.

Linux kernel builds that include the iSCSI/iSER module and do not incorporate the upstream patch to count deferred control PDU completions before connection teardown are affected. All kernel versions prior to the commit that introduces a completion counter in isert_wait_conn are potentially vulnerable, regardless of distribution. The flaw is not limited to a particular vendor‑specific kernel but applies to any distribution providing the iSCSI/iSER components.

The CVSS score of 8.1 indicates high severity. EPSS < 1 % suggests a low current likelihood of exploitation but the vulnerability is listed in no CISA KEV catalog. Exploitation requires an attacker who can influence iSCSI or iSER traffic to the target system; thus hosts exposing these services are the primary attack surface. If the race condition is triggered, the privileged memory corruption can lead to arbitrary kernel code execution, granting full system compromise. The likely attack vector is remote iSCSI traffic that can trigger the deferred completion race.