open-iscsi iscsiuio CVE-2026-18727

The attacker must be on an adjacent network segment with IPv6 reachability to the target - this is not exploitable remotely over the internet, and the AV:A vector confines risk to the local broadcast domain or link-local scope. The target host must be running the open-iscsi iscsiuio daemon and must be actively engaged in a DHCPv6 exchange, specifically awaiting a DHCPv6 Advertise reply; the vulnerability is not triggerable outside this exchange window. The iSCSI interface must be configured to use DHCPv6 for IPv6 address assignment; hosts using static IPv6 addresses on iSCSI interfaces do not traverse this code path and are not vulnerable. Exploitation yields only a process crash (denial of service) - no code execution, privilege escalation, or data disclosure is achievable via this vector. The timing dependency (active DHCPv6 exchange) and adjacency requirement together significantly limit opportunistic or automated mass exploitation.

The CVSS 6.5 with AV:A (adjacent network) is well-calibrated: exploitation is not remotely possible over the open internet and requires the attacker to occupy the same Layer 2 or IPv6 link-local segment as the target. AC:L/PR:N/UI:N confirms low exploitation complexity with no authentication required from the attacker side, which meaningfully lowers the bar in shared or data-center environments. Impact is strictly availability (A:H, C:N, I:N) - a process crash disrupts iSCSI storage but cannot exfiltrate data or execute code. No EPSS score is available in the provided data, so quantitative exploitation probability cannot be stated. No CISA KEV listing and no public POC exist at time of analysis, suggesting this has not been broadly weaponized. In storage-critical environments where iSCSI connectivity underlies virtual machine storage or database I/O, a daemon crash could cascade into significant operational disruption, making the effective business risk higher than the raw CVSS score implies. Isolated storage VLANs substantially reduce realistic exploitability.

An attacker positioned on the same network segment as an iSCSI initiator running open-iscsi on RHEL 9 or 10 observes or actively provokes a DHCPv6 exchange (for example, by spoofing a DHCPv6 Solicit or simply waiting for a scheduled renewal). The attacker then responds with a crafted DHCPv6 Advertise packet bearing a UDP length field shorter than the actual payload, causing iscsiuio's length calculation to underflow and triggering an out-of-bounds read that crashes the daemon. The resulting iscsiuio crash severs the iSCSI session, potentially unmounting storage volumes and disrupting any workloads - virtual machines, databases, or file systems - dependent on that iSCSI target.