CVE-2026-18726: Open-iSCSI Denial of Service Vulnerability

CVE-2026-18726 Overview

CVE-2026-18726 is a denial-of-service vulnerability in the iscsiuio daemon shipped with open-iscsi. A remote attacker on the same local network segment can send a crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement containing a zero-length option to trigger an infinite loop [CWE-835]. The loop drives sustained CPU consumption and renders the daemon unresponsive, degrading system availability. A secondary out-of-bounds read condition exists when the daemon processes short IPv6 payloads, though memory corruption and data exposure have not been confirmed. The vulnerability requires no authentication and no user interaction.

Critical Impact
Adjacent-network attackers can render the iscsiuio daemon unresponsive by sending a single malformed ICMPv6 Router Advertisement, disrupting iSCSI storage connectivity.

Affected Products

open-iscsi iscsiuio daemon
Linux distributions packaging open-iscsi (see Red Hat CVE-2026-18726 Advisory)
Systems using iSCSI storage on IPv6-enabled network segments

Discovery Timeline

2026-08-12 - CVE CVE-2026-18726 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18726

Vulnerability Analysis

The iscsiuio daemon handles user-space networking for iSCSI hardware offload adapters, including processing of IPv6 neighbor discovery traffic. The vulnerability resides in the code path that parses ICMPv6 Router Advertisement option fields. When the daemon encounters an option with a declared length of zero, its parser fails to advance its position pointer, so the option-processing loop never terminates.

The result is 100% CPU utilization on the thread handling the offending packet. The daemon stops servicing legitimate iSCSI control-plane traffic, which can interrupt storage sessions and block new connections. Because ICMPv6 Router Advertisements are link-local by design, the attacker must sit on the same broadcast domain as the target host.

Root Cause

The defect maps to CWE-835: Loop with Unreachable Exit Condition. The ICMPv6 option parser trusts the length byte of each Type-Length-Value (TLV) option without validating that the value is non-zero. When length equals zero, the loop increment resolves to zero bytes and the parser re-reads the same header indefinitely.

A related weakness exists in the IPv6 payload handling logic. When the received packet is shorter than the parser assumes, iscsiuio reads past the end of the receive buffer. No memory corruption or information disclosure has been demonstrated, but the bounds-checking gap remains a defensive weakness.

Attack Vector

Exploitation requires network adjacency, typically Layer 2 access to the same VLAN or IPv6 link-local segment as the target. An attacker crafts an ICMPv6 Router Advertisement in which at least one option field carries a length value of zero and transmits the packet to the all-nodes multicast address or the target's unicast address. The iscsiuio daemon receives the packet, enters the option-parsing loop, and hangs. No credentials, prior compromise, or user interaction are required. Details are described in the Red Hat Bugzilla Report #2462331.

Detection Methods for CVE-2026-18726

Indicators of Compromise

Sudden and sustained 100% CPU utilization by the iscsiuio process without a corresponding increase in iSCSI I/O workload
iscsiuio becoming unresponsive to control commands or failing to service new iSCSI sessions
Unexpected ICMPv6 Router Advertisement traffic originating from non-router hosts on the local segment
ICMPv6 Router Advertisement packets containing options with a length field of zero

Detection Strategies

Monitor process-level CPU metrics for iscsiuio and alert when utilization exceeds a sustained threshold
Deploy network intrusion detection signatures that inspect ICMPv6 Router Advertisement option TLVs for zero-length values
Correlate iSCSI session timeouts with concurrent ICMPv6 activity on the affected VLAN

Monitoring Recommendations

Enable RA Guard on managed switches to restrict which ports may transmit ICMPv6 Router Advertisements
Log all ICMPv6 Router Advertisement senders and alert on unauthorized sources
Track iscsiuio process liveness through service-monitoring tooling and generate alerts on hangs or restarts

How to Mitigate CVE-2026-18726

Immediate Actions Required

Apply vendor-supplied open-iscsi updates as they become available from your Linux distribution
Enable IPv6 RA Guard or equivalent Layer 2 controls on switches serving hosts that run iscsiuio
Restrict Layer 2 access to storage-adjacent VLANs to trusted systems only
Inventory hosts running iscsiuio and prioritize patching for systems reachable from user networks

Patch Information

Refer to the Red Hat CVE-2026-18726 Advisory for updated package versions and errata. Distribution maintainers are expected to backport the parser fix, which validates that ICMPv6 option length values are non-zero before continuing the parsing loop. Verify fixed package versions with your distribution's security tracker before deploying.

Workarounds

Disable IPv6 on interfaces where iSCSI traffic does not require it, using sysctl net.ipv6.conf.<interface>.disable_ipv6=1
Stop the iscsiuio service on hosts that do not require iSCSI hardware offload
Deploy host-based firewall rules to drop ICMPv6 Router Advertisements from untrusted sources

bash

# Configuration example: block ICMPv6 Router Advertisements from non-router hosts
# Allow RAs only from the trusted upstream router link-local address
ip6tables -A INPUT -p icmpv6 --icmpv6-type router-advertisement \
  ! -s fe80::1 -j DROP

# Disable IPv6 on an interface that does not need it
sysctl -w net.ipv6.conf.eth0.disable_ipv6=1