CVE-2026-18727: open-iscsi iscsiuio DHCPv6 DoS Vulnerability

CVE-2026-18727 Overview

A flaw exists in the iscsiuio component of open-iscsi. The vulnerability is an integer underflow leading to an out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length causes the DHCPv6 payload length calculation to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending crafted IPv6 UDP packets while the client participates in an active DHCPv6 exchange. Successful exploitation results in a denial of service through a process crash or service disruption. The flaw is tracked under [CWE-191] Integer Underflow.

Critical Impact
An unauthenticated adjacent-network attacker can crash the iscsiuio process by sending malformed DHCPv6 Advertise traffic, disrupting iSCSI storage connectivity.

Affected Products

open-iscsi iscsiuio component
Linux distributions packaging open-iscsi with iscsiuio (see Red Hat advisory for specific package builds)
Systems using DHCPv6 for iSCSI initiator network configuration

Discovery Timeline

2026-08-12 - CVE-2026-18727 published to the National Vulnerability Database (NVD)
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-18727

Vulnerability Analysis

The iscsiuio daemon provides a userspace I/O interface for iSCSI hardware offload adapters. It processes DHCPv6 traffic to obtain network configuration for iSCSI boot and initiator functions. During parsing of DHCPv6 Advertise messages, the daemon derives the DHCPv6 payload length by subtracting header sizes from the UDP length field. When an attacker supplies a UDP length shorter than the expected header sizes, this subtraction wraps below zero and produces a very large unsigned value. The code then treats this underflowed length as a valid buffer size and reads beyond the bounds of the received packet buffer.

The out-of-bounds read causes the process to access memory outside the intended packet region. This typically results in a segmentation fault and termination of iscsiuio, breaking iSCSI storage connectivity for the affected host.

Root Cause

The root cause is missing validation of the attacker-controlled UDP length field before it is used in arithmetic. The parser does not verify that the UDP length is greater than or equal to the combined UDP and DHCPv6 header sizes. This omission allows the length computation to underflow, producing an invalid payload length used in subsequent read operations.

Attack Vector

Exploitation requires network adjacency, meaning the attacker must reside on the same broadcast domain or IPv6 link as the target. The attacker crafts a DHCPv6 Advertise message with a UDP length shorter than valid header sizes and transmits it while the victim client is in an active DHCPv6 solicit/advertise exchange. No authentication or user interaction is required. The impact is limited to availability: the iscsiuio service crashes, disrupting iSCSI sessions that depend on it.

No public proof-of-concept exploit code is available for this issue at the time of publication. Refer to the Red Hat CVE-2026-18727 Advisory and Red Hat Bug Report #2462956 for authoritative technical details.

Detection Methods for CVE-2026-18727

Indicators of Compromise

Unexpected termination or repeated restarts of the iscsiuio daemon in system logs (journalctl -u iscsiuio, /var/log/messages)
Segmentation fault entries or core dumps referencing iscsiuio in kernel or systemd logs
Loss of iSCSI session connectivity correlated with DHCPv6 exchanges on the local link

Detection Strategies

Monitor host telemetry for abnormal exits of the iscsiuio process and correlate with concurrent DHCPv6 traffic on the interface
Inspect IPv6 UDP packets on port 546 for DHCPv6 Advertise messages where the UDP length field is smaller than the sum of the UDP and DHCPv6 headers
Enable core dump collection for iscsiuio to capture crash artifacts for forensic analysis

Monitoring Recommendations

Alert on iSCSI initiator session drops that coincide with DHCPv6 activity on adjacent segments
Ingest process crash events and network flow logs into a centralized data lake to identify patterns across hosts
Track DHCPv6 traffic volume from unauthorized sources on server VLANs where iSCSI boot or initiator services operate

How to Mitigate CVE-2026-18727

Immediate Actions Required

Apply vendor-supplied open-iscsi package updates as soon as they are available for your Linux distribution
Restrict IPv6 DHCPv6 traffic on server segments to trusted DHCPv6 relays and servers only
Disable iscsiuio on hosts that do not require iSCSI hardware offload adapters

Patch Information

Refer to the Red Hat CVE-2026-18727 Advisory and Red Hat Bug Report #2462956 for fixed package versions and errata. Distribution maintainers should backport the input validation fix that verifies the UDP length is at least the size of the UDP and DHCPv6 headers before computing the payload length.

Workarounds

Configure static IPv6 addressing for iSCSI initiators to avoid reliance on DHCPv6
Apply IPv6 access control lists on switches to block DHCPv6 messages from untrusted ports (DHCPv6 guard)
Stop and mask the iscsiuio service on systems that do not use Broadcom/QLogic iSCSI offload hardware

bash

# Disable iscsiuio where iSCSI hardware offload is not required
sudo systemctl stop iscsiuio.socket iscsiuio.service
sudo systemctl mask iscsiuio.socket iscsiuio.service

# Verify service state
systemctl status iscsiuio.service