CVE-2026-18728: open-iscsi iscsiuio DoS Vulnerability

CVE-2026-18728 Overview

CVE-2026-18728 is an integer underflow vulnerability in the iscsiuio component of open-iscsi. The flaw occurs during IPv4 Dynamic Host Configuration Protocol (DHCP) reply parsing. An attacker on the same local network segment can send a specially crafted IPv4/UDP DHCP reply to trigger an out-of-bounds read. The result is a crash of the iscsiuio process, producing a denial-of-service condition. The issue is tracked under CWE-191 (Integer Underflow) and affects any system where iscsiuio is actively processing IPv4 DHCP traffic.

Critical Impact
A single crafted DHCP reply from an adjacent network attacker can crash iscsiuio, disrupting iSCSI storage connectivity on affected Linux hosts.

Affected Products

open-iscsi iscsiuio component (userspace I/O daemon for iSCSI offload engines)
Red Hat Enterprise Linux distributions shipping vulnerable iscsiuio builds
Any Linux system running iscsiuio with IPv4 DHCP enabled on iSCSI interfaces

Discovery Timeline

2026-08-13 - CVE-2026-18728 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-18728

Vulnerability Analysis

The vulnerability resides in the DHCP parsing logic within iscsiuio, the userspace component that manages network traffic for iSCSI hardware offload engines such as Broadcom bnx2/bnx2x adapters. When iscsiuio receives an IPv4 DHCP reply, it computes a length value used to iterate through DHCP options. A malformed packet causes this length calculation to underflow, wrapping an unsigned integer to a large positive value.

The underflowed length then drives a read past the bounds of the packet buffer. The resulting memory access triggers a segmentation fault and terminates the iscsiuio process. Because iscsiuio handles offloaded iSCSI network setup, its crash disrupts storage sessions that depend on the affected interface. The attack requires no authentication or user interaction.

Root Cause

The root cause is insufficient validation of length fields parsed from an attacker-supplied DHCP reply. Arithmetic on these fields is performed without confirming that the value stays within the bounds of the received packet. When a crafted length produces an integer underflow, subsequent memory operations reference addresses outside the intended buffer, classified as CWE-191.

Attack Vector

Exploitation requires adjacent network access. The attacker must be on the same local network segment as the target and able to send UDP traffic on port 68 that reaches the victim's DHCP client path in iscsiuio. A rogue DHCP server, an on-path attacker, or a compromised host on the same broadcast domain can send the crafted reply. The impact is limited to availability. There is no confidentiality or integrity impact, and no code execution has been demonstrated.

See the Red Hat CVE-2026-18728 Advisory and the Red Hat Bug 2463029 Report for vendor-supplied technical details.

Detection Methods for CVE-2026-18728

Indicators of Compromise

Unexpected termination of the iscsiuio process, visible in systemd journal entries or dmesg output referencing a segmentation fault.
Loss of iSCSI session connectivity on interfaces served by offload engines that depend on iscsiuio.
Presence of malformed DHCP reply packets on the local segment, particularly replies with anomalous option length fields.

Detection Strategies

Monitor process supervision logs for repeated iscsiuio crashes or restart loops on hosts using iSCSI offload hardware.
Deploy network intrusion detection signatures that flag DHCP replies with truncated or inconsistent option length values.
Correlate DHCP traffic anomalies on storage-facing VLANs with iscsiuio service state changes.

Monitoring Recommendations

Alert on iscsiuio service failures through host telemetry and forward events to a centralized log platform.
Capture DHCP traffic on iSCSI network segments and inspect for non-compliant option encodings.
Track iSCSI session drops and correlate them with adjacent-network events for early identification of exploitation attempts.

How to Mitigate CVE-2026-18728

Immediate Actions Required

Inventory hosts running open-iscsi with the iscsiuio daemon enabled, focusing on systems using Broadcom or QLogic iSCSI offload adapters.
Apply vendor-supplied updates from the Red Hat CVE-2026-18728 Advisory once available for your distribution.
Restrict DHCP traffic on iSCSI network segments to trusted DHCP servers using DHCP snooping on managed switches.

Patch Information

At the time of publication, refer to the Red Hat CVE-2026-18728 Advisory and the Red Hat Bug 2463029 Report for patch availability and package versions. Upstream fixes will be delivered through the open-iscsi project and downstream distribution channels.

Workarounds

Disable iscsiuio on hosts that do not require iSCSI hardware offload by stopping and masking the iscsiuio.socket and iscsiuio.service units.
Configure iSCSI initiator interfaces with static IP addresses instead of DHCP where operationally feasible.
Enforce DHCP snooping and port-security controls on switches serving storage VLANs to block rogue DHCP replies.

bash

# Disable iscsiuio where iSCSI hardware offload is not needed
sudo systemctl stop iscsiuio.service iscsiuio.socket
sudo systemctl mask iscsiuio.service iscsiuio.socket

# Verify the daemon is no longer running
systemctl status iscsiuio.service