diff --git a/doc/iscsi.md b/doc/iscsi.md
index b54b63525..3e1b50469 100644
--- a/doc/iscsi.md
+++ b/doc/iscsi.md
@@ -170,4 +170,11 @@ return with check condition status. Then the LUN starts one poller which will
 wait for all the commands which have already been submitted to block device to
 return back; after all the commands return back, the LUN will be deleted.
 
+## Known bugs and limitations {#iscsi_hotplug_bugs}
+
+For write command, if you want to test hotplug with write command which will
+cause r2t, for example 1M size IO, it will crash the iscsi tgt.
+For read command, if you want to test hotplug with large read IO, for example 1M
+size IO, it will probably crash the iscsi tgt.
+
 @sa spdk_nvme_probe