An issue was discovered in the Linux kernel through 5.11.3. A kernel
pointer leak can be used to determine the address of the iscsi_transport
structure. When an iSCSI transport is registered with the iSCSI subsystem,
the transport's handle is available to unprivileged users via the sysfs
file system, at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When
read, the show_transport_handle function (in
drivers/scsi/scsi_transport_iscsi.c) is called, which leaks the handle.
This handle is actually the pointer to an iscsi_transport struct in the
kernel module's global variables.

Adam Nichols discovered that the iSCSI subsystem in the Linux kernel did
not properly restrict access to iSCSI transport handles. A local attacker
could use this to cause a denial of service or expose sensitive information
(kernel pointer addresses).