CVE-2026-115486

A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.

This flaw is rated Moderate because exploitation requires adjacent-network access to a Layer 2 segment where iscsiuio is processing IPv6 NDP traffic on a hardware iSCSI offload NIC. Systems without iSCSI offload hardware are not affected. The iscsiuio daemon is socket-activated and only runs when the hardware is present and configured. The deterministic ARP poisoning component does not require any heap manipulation, making it reliably exploitable from the local segment, but the impact is limited to traffic redirection within the iSCSI storage network.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Keep iscsiuio-managed interfaces on trusted L2 segments only. Where operationally acceptable, filter ICMPv6 Neighbor Advertisement (type 136) and Neighbor Solicitation (type 135) messages from untrusted sources using firewall rules.