A flaw in the Linux kernel’s iSCSI TCP implementation fails to verify the data direction before copying a Data‑In protocol data unit into a command’s buffer. If a target responds to a WRITE command with a Data‑In segment, the kernel incorrectly writes the target’s payload into the initiator’s page cache or O_DIRECT buffer, overwriting user supplied data. This can corrupt or silently overwrite data on the initiator side but does not lead to code execution or external disclosure of data.

The vulnerability affects the Linux kernel where the libiscsi_tcp driver resides. No specific patch version is listed in the available data; it is known that a fix has been merged into the kernel code. All current and legacy kernel releases that include the vulnerable libiscsi_tcp module are potentially impacted until a patched kernel is installed.

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at the time of this analysis. The vulnerability permits a malicious iSCSI target to supply data that overwrites user supplied data when responding to a WRITE command. This can corrupt data on the initiator side but does not lead to code execution or external disclosure of data. Potential exploitation requires the attacker to control or influence the target device; this inference is drawn from the vulnerability description but is not explicitly stated in the input.