CVE-2026-115486
HighCVSS 7.1Summary
In the iscsiuio component of open-iscsi, the IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
Risk Assessment
An attacker on the same network can poison the ARP table and redirect network traffic, enabling eavesdropping or modification of communications (man-in-the-middle).
Recommendation
Update open-iscsi to a patched version and consider implementing ARP poisoning protections such as Dynamic ARP Inspection.
Other vulnerabilities in open-iscsi iscsiuio
See all- CVE-2026-115485Medium
In the iscsiuio component of open-iscsi, the DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
- CVE-2026-115484High
In the iscsiuio component of open-iscsi, the DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
Original NVD description (English source)
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS