A high-severity NULL pointer dereference flaw in the Linux kernel SCSI target subsystem could allow an unauthenticated attacker to cause a system crash.

The vulnerability exists in the iblock_execute_pr_out function, where inadequate validation of SCSI persistent reservation operations results in an incorrect NULL pointer check. An unauthenticated attacker can trigger this flaw by sending specific commands that dereference a NULL function pointer, resulting in a kernel panic.

The vulnerability carries a CVSS score of 7.5, reflecting its potential to cause significant service disruption. Successful exploitation results in a kernel panic, leading to immediate system downtime and loss of availability for any services relying on the affected storage target, which poses a substantial risk to business continuity.

Immediate Action: Update the Linux kernel to version 6.6.151, 6.12.103, 6.18.44, 7.1.8, or later versions as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages specifically related to SCSI target operations or the iblock module.

Compensating Controls: Restrict network access to SCSI target interfaces to authorized management segments to reduce the attack surface.

Public Exploit Available: Unknown

Given the critical nature of kernel-level vulnerabilities, organizations should prioritize patching affected systems. Administrators must verify the kernel version currently running in their production environment and apply the necessary updates to prevent potential service instability caused by this NULL pointer dereference.