The Linux kernel contains a critical buffer overflow vulnerability in its iSCSI target implementation that could allow an unauthenticated remote attacker to achieve arbitrary code execution.

This is a heap-based buffer overflow occurring in the chap_server_compute_hash function. An unauthenticated attacker can supply a specially crafted iSCSI CHAP authentication response that exceeds the allocated buffer size during base64 decoding, leading to memory corruption.

Successful exploitation of this vulnerability allows a remote, unauthenticated attacker to execute arbitrary code with kernel-level privileges. This presents a catastrophic risk to business operations, as it enables full system compromise, exfiltration of sensitive data, and potential lateral movement across the network. The CVSS score of 9.8 reflects the high severity of this flaw, as it requires no user interaction and no prior authentication to trigger.

Immediate Action: Update the Linux kernel to version 6.1.176, 6.6.143, 6.12.93, 6.18.35, or any later stable release provided by your distribution vendor.

Proactive Monitoring: Review system logs for unusual kernel crashes or iSCSI connection failures that may indicate exploitation attempts.

Compensating Controls: Restrict network access to iSCSI target interfaces to trusted management subnets using firewall rules to prevent unauthorized remote access to the vulnerable service.

Public Exploit Available: Unknown

Given the critical nature of this kernel-level vulnerability and the potential for full system compromise, immediate patching is required. IT administrators should prioritize the deployment of the provided kernel updates across all affected infrastructure, particularly on systems exposing iSCSI services to the network.