A vulnerability in the Linux kernel's libiscsi SCSI subsystem allows a negative task index to be used in parse_pdu_itt, leading to out-of-bounds array access. This occurs because the index is only checked for an upper bound but not for a lower bound, allowing negative values to access memory before the array. The issue arises specifically with beiscsi transport handling unsolicited NOP-In PDUs with unvalidated ITT values. The flaw has been resolved by adding a lower bound check on the index.