Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-18726 EUVD-2026-57636GHSA-q9p8-qgxc-hw66

Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing

Published Aug 12, 2026 · Updated Nov 5, 2026 · Assigned by redhat

Description

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat Enterprise Linux 10 — —
Red Hat Red Hat Enterprise Linux 9 — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 open-iscsi 2.1.13-1 —
Debian 13 open-iscsi No fix yet —
Debian 12 open-iscsi 2.1.8-1+deb12u1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 open-iscsi No fix yet —
Ubuntu 26.04 LTS open-iscsi No fix yet —
Ubuntu 24.04 LTS open-iscsi No fix yet —
Ubuntu 22.04 LTS open-iscsi No fix yet —
Ubuntu 20.04 LTS open-iscsi No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS open-iscsi No fix yet —
Ubuntu Pro 18.04 LTS open-iscsi No fix yet —
Ubuntu Pro 16.04 LTS open-iscsi No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP5 open-iscsi 2.1.13-150500.46.6.1 SUSE-SU-2026:5224-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 open-iscsi 2.1.13-150500.46.6.1 SUSE-SU-2026:5224-1
SLE Micro 5.5 open-iscsi 2.1.13-150500.46.6.1 SUSE-SU-2026:5224-1
SLE HPC 15 SP5 open-iscsi 2.1.13-150500.46.6.1 SUSE-SU-2026:5224-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed open-iscsi 2.1.13-114.1 openSUSE-SU-2026:12102-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 iscsi-initiator-utils +3 6.2.1.4-10.git2a8f9d8.amzn2023.0.4 ALAS2023-2026-2120
Amazon Linux 2 iscsi-initiator-utils +2 6.2.0.874-7.amzn2.0.2 ALAS2-2026-3897

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 iscsi-initiator-utils No fix yet —

Advisories 4

References