Live › vulnerability › CVE-2026-115486
Go to dashboardiscsiuio (open-iscsi) reads IPv6 Neighbor Discovery link-layer options without a length check and updates the ARP table from packet headers, so a host on the same L2 segment can poison ARP and redirect iSCSI traffic. Only hosts using iSCSI offload NICs (QLogic/Broadcom bnx2, bnx2x, qedi) with the iscsiuio daemon running are exposed. Software iSCSI (plain iscsid on ordinary NICs) and systems without offload hardware can skip it. Red Hat mitigation: keep iscsiuio interfaces on trusted L2 segments and filter ICMPv6 type 135/136 from untrusted sources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts that run iscsiuio from open-iscsi, typically those using iSCSI boot or offload, are the systems to look at. The sources do not say which versions are affected or whether hosts without iscsiuio running can skip it. The attacker needs to be on the same layer-2 network segment.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| open-iscsi | linux | all versions (no fixed version published; Debian 2.1.8-2.1.13 listed vulnerable) | – |
systemctl status iscsiuio or pgrep iscsiuio to see whether the daemon runs, and iscsiadm -m iface to look for bnx2i/qedi offload transportsdpkg -l open-iscsi or rpm -q iscsi-initiator-utilsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
This page as .md · .json · in your agent: get_signal("CVE-2026-115486")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.