A race condition vulnerability in the Linux kernel iSER target driver allows unauthenticated remote attackers to trigger a system crash, resulting in a denial of service.

The vulnerability exists in the isert_put_login_tx function, where receive buffers are posted before session registration is complete. This allows an initiator to send commands against an uninitialized session, triggering a null pointer dereference and a kernel oops.

Successful exploitation of this vulnerability results in a kernel panic, effectively crashing the affected host or storage target. This causes significant system downtime and disruption to storage services, which can impact business continuity for any infrastructure relying on iSER for high-performance block storage. With a CVSS score of 7.5, this represents a high-severity risk to availability.

Immediate Action: Update the Linux kernel to the patched versions: 5.10.270, 5.15.221, 6.1.188, 6.6.157, or newer.

Proactive Monitoring: Monitor system logs for kernel oops messages, specifically those referencing target_submit or isert driver modules, which may indicate attempted exploitation.

Compensating Controls: Restrict network access to iSER/RDMA ports to trusted initiator IP addresses only to prevent unauthorized access to the target driver.

Public Exploit Available: No (exploit_available: false)

Given the potential for complete system disruption via a kernel-level denial of service, administrators of storage infrastructure utilizing iSER over RDMA should prioritize the application of the kernel patches. Ensure that production environments are updated during the next available maintenance window to mitigate the risk of system instability.