A Reject PDU sent to a Linux iSCSI target carries a copy of the header it rejects, and the kernel extracts the ITT value from that copy to locate the corresponding task. The code fails to validate that the ITT is a legitimate in‑flight task: it merely bounds the index against the maximum number of commands. An attacker can supply an arbitrary ITT that points to an unused or already freed task slot. When the kernel resolves this ITT, it may obtain a NULL or stale task pointer, causing a null‑pointer dereference, a warning, or a reference‑count underflow if the task had been previously freed. Because these failures occur in the kernel address space, a successful exploitation could lead to arbitrary memory corruption and ultimately arbitrary code execution in privileged mode.

All Linux kernel builds that include the iSCSI library and do not contain the patch found in commit 7215a69b6456fda79c0935c2959045dff3fcaac8. The issue exists in kernels before the 7.2.0 release series where the security fix was applied.

The vulnerability involves kernel memory corruption, which is a high‑severity flaw. No CVSS score is listed, and the EPSS score is not available; the vulnerability is also not listed in KEV, which does not diminish its potential impact. The attack vector is remote over an iSCSI session, requiring the attacker to be able to send custom PDUs to the target. If the target is exposed to the network, exploitation is feasible and could lead to full system compromise. The exploit is straightforward once the target accepts iSCSI connections from an attacker’s host, and the lack of validation provides a direct path to manipulate kernel data structures.