The flaw in the Linux kernel’s libiscsi module allows a management response to reference an iSCSI task that is not in flight. Instead of verifying that the task index corresponds to a valid, active task, the code only checks that the index is within bounds. When the referenced task does not exist, a null pointer dereference occurs during completion of the response, producing a general protection fault and kernel panic. This results in a denial of service on the affected host.

The vulnerability affects all Linux kernel versions that include the libiscsi code prior to the fix, regardless of distribution. Any Linux installation using an iSCSI target or initiator that communicates with a compromised or malicious target is susceptible. The exact kernel version is not specified, so all kernels that ship the vulnerable code are at risk until patched.

The vulnerability can be triggered by sending a crafted iSCSI response—such as an unsolicited NOP‑In or a malformed Text Response—over an established iSCSI connection. The attacker must be able to communicate with the target as an initiator or target, but no higher privilege is required beyond the normal iSCSI control channel. Because the flaw causes a hard kernel lockup, exploitation leads to a denial‑of‑service scenario. No CVSS score is provided, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog.