CVE-2026-18726

Analyzed Analyzed - Analysis Complete

Denial of Service in open-iscsi via ICMPv6 Router Advertisement

Publication date: 2026-08-12

Last updated on: 2026-08-25

Assigner: redhat-SADP

Description

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-25

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-18726

EUVD

EUVD-2026-57636

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	enterprise_linux	9.0
redhat	enterprise_linux	10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability is a Denial of Service (DoS) flaw in open-iscsi. A remote attacker on the same local network can exploit it by sending a specially crafted ICMPv6 Router Advertisement with a zero-length option. This triggers an infinite loop in the iscsiuio daemon, causing high CPU usage and making the daemon unresponsive. There is also a secondary risk of out-of-bounds reads with short IPv6 payloads, but no confirmed memory corruption or data exposure.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual CPU usage in the iscsiuio daemon or network traffic containing malformed ICMPv6 Router Advertisements. Check if open-iscsi is installed and running. Use tools like 'top' or 'htop' to observe CPU spikes in iscsiuio. Monitor network traffic with tcpdump or Wireshark for ICMPv6 packets with zero-length options.

Impact Analysis

This vulnerability can impact you by causing your system to become unresponsive due to high CPU usage in the iscsiuio daemon. This leads to a Denial of Service, making the affected service unavailable and potentially disrupting network storage operations.

Compliance Impact

This vulnerability primarily causes a Denial of Service (DoS) in the iscsiuio daemon, leading to sustained CPU usage and system unavailability. It does not directly impact data confidentiality or integrity, which are key focus areas for GDPR and HIPAA. However, prolonged system unavailability could indirectly affect compliance by disrupting access to critical data or services, potentially violating availability requirements in these regulations.

Mitigation Strategies

Immediately update open-iscsi to the latest patched version. If an update is unavailable, disable the iscsiuio daemon if not required. Restrict network access to trusted sources by configuring firewalls to block ICMPv6 Router Advertisements from untrusted networks. Monitor affected systems for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-18726. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70