CVE-2026-115485

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.

This flaw is rated Moderate because exploitation requires adjacent-network access during a narrow timing window (DHCPv6 solicit phase) on a Layer 2 segment where iscsiuio is processing DHCPv6 traffic on a hardware iSCSI offload NIC. Systems without iSCSI offload hardware are not affected. The iscsiuio daemon is socket-activated and only runs when the hardware is present and configured.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If DHCPv6 is not required for iscsiuio, disable DHCPv6 handling for the relevant network interface. If DHCPv6 is necessary, restrict network exposure to trusted adjacent networks and implement firewall rules to prevent forged DHCPv6 server traffic from reaching clients on shared L2 segments.