A critical out-of-bounds memory read vulnerability in the Linux kernel SCSI target subsystem could allow an unauthenticated attacker to crash the system or potentially execute arbitrary code.

The flaw exists in the handling of PERSISTENT RESERVE OUT parameter buffers, where the kernel fails to validate buffer lengths during iSCSI TransportID parsing. An unauthenticated attacker can supply a malformed TransportID to trigger an out-of-bounds read, leading to a kernel oops.

This vulnerability carries a CVSS score of 9.8, reflecting its critical severity due to the lack of required authentication and the potential for complete system compromise. Successful exploitation results in a denial of service via kernel panic, and potentially allows an attacker to achieve remote code execution, threatening the confidentiality, integrity, and availability of sensitive data stored on affected storage infrastructure.

Immediate Action: Update the Linux kernel to the patched versions provided by your distribution or the mainline stable releases: 5.10.266, 5.15.212, 6.1.178, or 6.6.145.

Proactive Monitoring: Monitor kernel logs for "KASAN: vmalloc-out-of-bounds" errors or unexpected system restarts which may indicate attempted exploitation.

Compensating Controls: Restrict access to iSCSI target interfaces to trusted management networks and ensure that storage traffic is segmented from public-facing services to reduce the attack surface.

Public Exploit Available: Unknown

Given the critical nature of this kernel-level flaw and the potential for total system compromise, organizations should prioritize patching as part of their next maintenance cycle. Ensure that all systems utilizing iSCSI targets are updated to the specified stable kernel versions to eliminate the risk of memory corruption and service disruption.