open-iscsi CVE-2026-18726

The iscsiuio daemon must be running on the target system, which occurs when iSCSI hardware offload (iSCSI over Ethernet using compatible NICs) is configured - this is not the default for software iSCSI initiator use. The attacker must have layer-2 or VLAN adjacency to the target host (CVSS AV:A); internet-routed exploitation is not possible. No authentication or privileges are required (PR:N). The target system must be running Red Hat Enterprise Linux 9 or 10 with the affected open-iscsi package version installed and the iscsiuio service active. Exploitation is limited by: the adjacent-network constraint (isolating risk to LAN/VLAN-level adversaries), the requirement for iscsiuio to be actively running (non-default in pure software-iSCSI deployments), and the absence of any IPv6 source filtering that would block spoofed RA messages.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 6.5) accurately reflects the threat profile: a trivially crafted, unauthenticated packet reliably collapses the daemon, but only from the same local network segment. The adjacent-network constraint is the decisive limiting factor - direct internet exploitation is not possible, and the attacker must already have L2 or VLAN adjacency to the target. EPSS data was not provided, so exploitation probability cannot be quantified; given the absence of both a KEV listing and any identified POC, opportunistic mass exploitation appears unlikely at this time. The secondary OOB-read risk noted in the description warrants attention - the Buffer Overflow and Information Disclosure tags hint at a potential path to information exposure, but no memory corruption has been confirmed, so this remains speculative and should not be weighted equally to the confirmed DoS path. For organizations running shared iSCSI storage infrastructure - including data-center operators where even a mid-sized municipal IT team in sopot would maintain network-attached block storage clusters - persistent loss of the iscsiuio daemon translates directly to storage I/O failures, making availability impact more severe than the moderate CVSS base score implies in practice. Overall priority is medium: urgent for environments actively using iSCSI hardware offload on RHEL 9/10, low for systems not running iscsiuio or where network segmentation prevents adjacent-network access.

An attacker with access to the same LAN segment or VLAN as a Red Hat Enterprise Linux host running iscsiuio crafts an ICMPv6 Router Advertisement packet containing a single option with a length field set to zero and broadcasts or unicasts it to the target. The iscsiuio daemon's option parsing loop immediately enters an infinite iteration, pegging CPU utilization and blocking all subsequent iSCSI processing, causing storage I/O to stall until the daemon is manually restarted or the system is rebooted. No exploit code or authentication is required beyond network adjacency.