CVE-2026-115484

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.

This flaw is rated Moderate because exploitation requires adjacent-network access to a Layer 2 segment where iscsiuio is processing IPv4 DHCP traffic on a hardware iSCSI offload NIC (Broadcom bnx2/bnx2x or QLogic qedi). Systems without iSCSI offload hardware are not affected. The iscsiuio daemon is socket-activated and only runs when the hardware is present and configured. iSCSI storage networks are typically isolated from general-purpose networks, further limiting attacker access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict untrusted systems from the L2 broadcast domain where iscsiuio-managed interfaces operate. If IPv4 DHCP is not required for iSCSI boot, configure static IP addressing. Where DHCP must remain enabled, limit DHCP/BOOTP traffic so only trusted infrastructure can reach the affected host.