A critical out of bounds read vulnerability exists in the Linux kernel iSER target driver, potentially allowing unauthenticated remote attackers to compromise system memory or cause service disruption.

The flaw resides in the isert_recv_done function, which fails to validate the data length declared in a PDU against the actual bytes received by the HCA. An unauthenticated attacker can exploit this by crafting malicious packets that force the system to perform an out of bounds read of the receive buffer.

Successful exploitation of this vulnerability can lead to unauthorized information disclosure or system instability. Given the kernel level nature of this flaw and the CVSS score of 9.1, the impact is severe as it allows remote attackers to bypass memory protections without requiring authentication, potentially leading to a denial of service or the exposure of sensitive kernel memory.

Immediate Action: Update the Linux kernel to the patched versions provided by your distribution (e.g., 5.10.270, 5.15.221, 6.1.188, 6.6.157 or later) immediately.

Proactive Monitoring: Monitor network traffic for anomalous iSCSI over RDMA (iSER) traffic patterns and review system logs for kernel panics or memory access violations.

Compensating Controls: If immediate patching is not feasible, restrict access to the iSER service to trusted network segments and ensure that RDMA interfaces are not exposed to untrusted networks.

Public Exploit Available: No

This vulnerability represents a significant risk to the stability and security of infrastructure utilizing iSER. Security teams must prioritize applying kernel updates across all affected systems. Given the potential for unauthenticated remote exploitation, delaying remediation increases the risk of successful compromise.