A critical out of bounds read vulnerability in the Linux kernel iSER target module allows unauthenticated remote attackers to compromise system memory and cause denial of service.

The vulnerability exists in the isert_login_recv_done function, which fails to compare the received PDU length against the length declared in the iSCSI login PDU header. This flaw allows an unauthenticated initiator to send a malicious PDU that causes the kernel to read past the end of a fixed 8192 byte buffer, potentially leaking memory or crashing the system.

The ability for an unauthenticated remote attacker to trigger a kernel level out of bounds read presents a significant risk to data confidentiality and system availability. Successful exploitation can lead to kernel memory disclosure or system crashes, resulting in service interruption for storage infrastructure relying on iSER. Given the CVSS score of 9.1, this represents a critical threat to enterprise environments.

Immediate Action: Update the Linux kernel to version 5.10.270, 5.15.221, 6.1.188, 6.6.157, or any subsequent stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel BUG entries or slab out of bounds errors, particularly those associated with the iscsi_target or isert modules.

Compensating Controls: Restrict network access to iSCSI target ports to known, trusted initiator IP addresses using firewall rules to limit the attack surface.

Public Exploit Available: Unknown.

This vulnerability is severe because it allows unauthenticated remote code execution or denial of service at the kernel level. Administrators should prioritize patching their Linux kernel environments immediately to prevent potential exploitation of this memory safety flaw.