The vulnerability is a null pointer dereference in the Linux ISER subsystem. When a target issues a remote invalidation command for a direction that has never been registered, the kernel's iser_check_remote_inv routine assumes a valid descriptor and reads desc->sig_protected. Because the descriptor pointer is NULL, this triggers a general protection fault and brings the system down. The result is a kernel panic that effectively terminates the node, exposing the host to a denial‑of‑service attack.

All Linux kernels that implement the unpatched iser_reg_mem_fastreg and iser_check_remote_inv paths are affected. This includes any upstream kernel tree that has not incorporated the commit that disables processing of remote invalidation for unregistered directions. No specific version range is listed, so any kernel derived from upstream Linux before the fix may be vulnerable.

The CVSS score of 5.5 and the EPSS score of < 1% indicate a medium severity and a very low probability of exploitation at the time of analysis. The bug is not listed in CISA’s KEV catalog and no public exploitation is known. Successful exploitation would result in a crash that temporarily denies service by halting the kernel. The likely attack vector requires an RDMA connection to the target and the ability to send a malformed ISER remote‑invalidation command. The kernel handles the command with the same defensibility as it does for unrequested invalidations, simply terminating the connection, but because the direction was never registered the dereference occurs instead of a graceful disconnect.