CVE-2023-52974

A vulnerability was found in the Linux kernel's iscsi tcp drivers. Improper resource allocation management can lead to a use-after-free scenario, triggered when the userspace attempts to access the session host's ipaddress attribute while the kernel is performing a session teardown via iscsi_session_teardown().

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access, specific race timing during memory allocation failure, and privileged control over software iSCSI session setup. Under standard Red Hat Enterprise Linux configurations, the iscsi_tcp driver is not loaded by default unless software iSCSI storage initiator services are explicitly configured and running. Consequently, environments that do not configure network-attached storage via software iSCSI are not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.