CVE-2026-18726 PUBLISHED

Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing

Assigner: redhat
Reserved: 03.08.2026 Published: 12.08.2026 Updated: 13.08.2026

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.

Metrics

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 6.5

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected

Workarounds

To mitigate this issue, restrict ICMPv6 Router Advertisements from untrusted sources on any network segment where iscsiuio interfaces are exposed. Alternatively, disable IPv6 Router Advertisement processing on affected interfaces if not operationally required. This may involve configuring firewall rules to filter ICMPv6 type 134 messages or adjusting network interface settings to prevent RA-driven IPv6 configuration. A service restart may be required for changes to take effect.

Credits

  • Red Hat would like to thank Keith Linneman (Linneman Labs) for reporting this issue.

References

Problem Types

  • Loop with Unreachable Exit Condition ('Infinite Loop') CWE