iscsiuio CVE-2026-115486

Exploitation requires that the iscsiuio daemon (open-iscsi userspace component for iSCSI hardware offload/boot, typically with supported Broadcom NICs) is actually running and processing IPv6 Neighbor Discovery traffic - it is not active on a default server without iSCSI offload configured. The attacker must be on the same Layer 2 network segment as the target (CVSS AV:A), since Neighbor Discovery/ARP operate link-locally; no authentication (PR:N) and no user interaction (UI:N) are needed, and a single minimal Neighbor Advertisement is sufficient (AC:L). The principal limiting factors are therefore network adjacency (no routed/remote reach) and whether iscsiuio is deployed and listening, not any special privilege or victim action.

This is a genuine but bounded network-adjacency risk rather than an internet-wide emergency. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, base 7.1) is internally consistent with the description: an attacker 'on the same network segment' (AV:A, not AV:N) can send a single crafted IPv6 Neighbor Advertisement (AC:L, PR:N, UI:N) to poison the ARP table (I:H via traffic redirection) with a secondary out-of-bounds read / crash potential (A:L, C:N). The reporting is from Red Hat and the vuln.today Decision label is 'this_week' - a notable-but-not-top priority. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so exploitation probability cannot be quantified from the data; the absence of these signals plus the AV:A adjacency requirement argues against mass, automatable exploitation and points to a localized/insider or compromised-segment threat model. One cross-signal tension worth flagging: the Tags include 'Buffer Overflow' and 'Information Disclosure' while the assigned CWE is CWE-125 (out-of-bounds read) and the primary described impact is integrity (ARP poisoning/MITM), not confidentiality - the vendor set C:N despite the 'Information Disclosure' tag, so treat the tag taxonomy as loose and defer to the CWE/CVSS. Bottom line: real priority for environments where iscsiuio is actually running on exposed L2 segments, lower priority elsewhere.

An attacker with a foothold on the same Layer 2 segment (e.g., a compromised host, rogue VM, or malicious device on a storage/iSCSI VLAN) sends a minimal, malformed IPv6 Neighbor Advertisement to a host running iscsiuio. The handler reads the link-layer address option at a fixed offset without checking it exists and unconditionally updates its ARP table with attacker-controlled addresses, enabling ARP cache poisoning and traffic redirection (MITM) while the out-of-bounds read may also leak adjacent memory or crash the daemon. No public exploit was identified at time of analysis.