CVE-2026-115486
Description
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
Statement
This flaw is rated Moderate because exploitation requires adjacent-network access to a Layer 2 segment where iscsiuio is processing IPv6 NDP traffic on a hardware iSCSI offload NIC. Systems without iSCSI offload hardware are not affected. The iscsiuio daemon is socket-activated and only runs when the hardware is present and configured. The deterministic ARP poisoning component does not require any heap manipulation, making it reliably exploitable from the local segment, but the impact is limited to traffic redirection within the iSCSI storage network.
Mitigation
Keep iscsiuio-managed interfaces on trusted L2 segments only. Where operationally acceptable, filter ICMPv6 Neighbor Advertisement (type 136) and Neighbor Solicitation (type 135) messages from untrusted sources using firewall rules.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.1 | N/A | 7.1 |
| Attack Vector | Adjacent Network | N/A | Adjacent Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
cve.org: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Red Hat CVSS v3 Score Explanation
IPv6 ND ARP poisoning is deterministic with attacker-controlled MAC/IP. C:N — 1-byte heap OOB read into ARP table is not meaningful disclosure. I:H — unconditional ARP table poisoning redirects traffic. A:L — corrupted ARP entries disrupt connectivity but crash unlikely. Lowered from 7.6 per AV:A OOB precedent review.
Acknowledgements
Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
