CVE-2026-55995 Overview
CVE-2026-55995 is a double free vulnerability [CWE-415] in open-iscsi, the open-source implementation of the iSCSI protocol used for block storage over IP networks. The flaw resides in the open-isns component responsible for Internet Storage Name Service (iSNS) attribute parsing. An unauthenticated attacker positioned as a man-in-the-middle (MITM) on the network can trigger the double free condition to cause a denial of service (DoS) against affected iSCSI initiators or servers. The issue affects open-iscsi up to and including commit 56718d4e9d1a4f51c30697b5c0534144bb41c9bb, at which point the fix was applied.
Critical Impact
A network-adjacent attacker without credentials can crash iSCSI/iSNS services, disrupting storage availability for dependent workloads and virtual machines.
Affected Products
- open-iscsi (upstream project) through commit 56718d4e9d1a4f51c30697b5c0534144bb41c9bb
- open-isns library component (attribute parsing in attrs.c)
- Linux distributions packaging vulnerable versions of open-iscsi / open-isns (see SUSE advisory)
Discovery Timeline
- 2026-07-29 - CVE-2026-55995 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-55995
Vulnerability Analysis
The vulnerability is a classic double free [CWE-415] in the iSNS attribute deserialization path. When open-isns parses an incoming attribute value of type string, it allocates a buffer with isns_malloc(len + 1) and stores the pointer in value->iv_string. If the subsequent buf_get() call fails to read the expected bytes, the error handler frees value->iv_string and returns. However, the pointer is not cleared after being freed. When higher-level cleanup routines later walk the attribute list and invoke the destructor, the same pointer is freed again, corrupting the heap allocator state.
Exploitation requires an attacker to inject or modify iSNS protocol messages on the wire. iSNS traffic is typically unauthenticated and unencrypted in default deployments, making a MITM position on the storage network sufficient to deliver a malformed attribute payload.
Root Cause
The root cause is missing pointer sanitization in the error path of the string attribute parser inside attrs.c. Freeing memory without setting the pointer to NULL allows a subsequent free of the same address through the standard attribute cleanup logic, producing heap metadata corruption and typically a process abort.
Attack Vector
The attack is delivered over the network with no privileges and no user interaction. An attacker with the ability to observe or inject iSNS packets between an initiator, target, or iSNS server sends a crafted attribute that causes buf_get() to return 0, triggering the vulnerable error path.
// Patch in attrs.c - Fix issue in error path causing double-free
value->iv_string = isns_malloc(len + 1);
if (!buf_get(bp, value->iv_string, len)) {
isns_free(value->iv_string);
+ value->iv_string = NULL;
return 0;
}
value->iv_string[len] = '\0';
// Source: https://github.com/open-iscsi/open-isns/commit/56718d4e9d1a4f51c30697b5c0534144bb41c9bb
Detection Methods for CVE-2026-55995
Indicators of Compromise
- Unexpected termination or repeated restarts of iscsid, isnsd, or related iSCSI daemons on Linux hosts.
- Kernel or glibc messages referencing double free or corruption associated with iSCSI processes in /var/log/messages or journalctl output.
- Anomalous iSNS traffic (TCP/UDP port 3205) originating from unexpected sources on the storage network.
Detection Strategies
- Monitor process crash telemetry for iscsid and isnsd and correlate with concurrent iSNS network activity.
- Deploy network intrusion detection signatures for malformed iSNS Protocol PDUs, particularly attributes whose declared length exceeds the payload provided.
- Inspect systemd service failure counters and core dumps for storage-plane daemons.
Monitoring Recommendations
- Aggregate host-level crash and service-restart events into a central SIEM or data lake to identify DoS patterns across the storage fleet.
- Log iSNS client-server sessions with source IP, timestamp, and packet size to help identify MITM injection attempts.
- Alert when iSCSI storage sessions on critical hosts drop unexpectedly during periods of active iSNS communication.
How to Mitigate CVE-2026-55995
Immediate Actions Required
- Update open-iscsi and open-isns packages to a build that includes commit 56718d4e9d1a4f51c30697b5c0534144bb41c9bb or later.
- Track the SUSE Bug Report CVE-2026-55995 and equivalent advisories from your Linux distribution for packaged fixes.
- Restrict iSNS traffic (TCP/UDP 3205) to a dedicated, isolated storage VLAN or management network.
Patch Information
The upstream fix is available in the open-isns commit 56718d4e, which sets value->iv_string = NULL after the error-path isns_free() call in attrs.c. Downstream distributions are expected to backport this change; consult vendor advisories for the specific package version containing the fix.
Workarounds
- Disable the iSNS client on iSCSI initiators where discovery is handled through static configuration or SendTargets.
- Enforce IPsec or a dedicated physical segment for iSCSI/iSNS traffic to eliminate MITM opportunities.
- Apply firewall rules that allow iSNS communication only between known initiator, target, and iSNS server addresses.
# Configuration example: restrict iSNS traffic to trusted hosts and disable client
# 1. Firewall (nftables) - only allow iSNS from trusted iSNS server
nft add rule inet filter input ip saddr != 10.10.20.5 tcp dport 3205 drop
nft add rule inet filter input ip saddr != 10.10.20.5 udp dport 3205 drop
# 2. Disable iSNS discovery in /etc/iscsi/iscsid.conf
sed -i 's/^isns.address.*/#&/' /etc/iscsi/iscsid.conf
sed -i 's/^isns.port.*/#&/' /etc/iscsi/iscsid.conf
systemctl restart iscsid
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
