CVE-2026-115486 in Red Hat
Summary
by MITRE • 10/23/2026
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the iscsiuio component of open-iscsi represents a critical security flaw rooted in improper input validation within the IPv6 Neighbor Discovery handler. This specific implementation error allows an attacker who has access to the same local area network segment as the target system to execute a sophisticated man-in-the-middle attack by poisoning the Address Resolution Protocol table, commonly referred to as ARP cache poisoning or neighbor discovery spoofing. The core technical deficiency lies in how the software processes incoming Neighbor Advertisement packets generated under the IPv6 protocol suite. Specifically, the handler attempts to extract link-layer address information from these packets by accessing data at a fixed memory offset without first verifying that such options are actually present within the packet structure. This lack of bounds checking and structural validation means that if an attacker crafts a maliciously formatted Neighbor Advertisement message that omits expected optional fields or contains truncated headers, the application will still proceed to read from the specified memory location, potentially retrieving garbage data or causing undefined behavior depending on what resides at that offset in memory.
Beyond the immediate risk of potential buffer over-reads or crashes due to invalid memory access, the more severe operational impact stems from how the software handles ARP table updates following this flawed parsing process. The vulnerability description indicates that the ARP table is updated unconditionally with addresses derived directly from attacker-controlled packet headers. In a standard and secure implementation, any update to critical network state tables like the ARP cache should be subject to strict validation checks to ensure the legitimacy of the source IP-to-MAC address mapping being proposed. By bypassing these verification steps, open-iscsi effectively trusts malicious input without question. An attacker can exploit this by sending a minimal Neighbor Advertisement packet that claims to originate from a legitimate gateway or target host but provides a MAC address controlled by the attacker. When the vulnerable iscsiuio component processes this packet, it blindly accepts the new mapping and updates its internal ARP table accordingly.
This behavior facilitates a classic network redirection attack where traffic intended for an iSCSI storage device or another critical infrastructure node on the local segment is instead routed to the attacker's machine. Since open-iscsi is responsible for managing Internet Small Computer Systems Interface connections, which are vital for block-level data access in enterprise environments, compromising its network state can lead to significant disruptions in availability and integrity of stored data. An adversary positioned within this network segment could intercept sensitive storage traffic, modify commands or responses before they reach their destination, or simply cause a denial of service by redirecting traffic into the void if no valid endpoint exists at the spoofed address. The ability to poison the ARP table effectively isolates the target from its intended communication partner while allowing the attacker to monitor and potentially alter all communications between them.
To mitigate this vulnerability, immediate action should be taken to apply vendor-provided patches that correct the input validation logic within the iscsiuio component. Developers must ensure that any parsing routine for Neighbor Discovery messages explicitly checks for the presence of required options before attempting to access their data at fixed offsets. Furthermore, conditional logic must be implemented so that ARP table updates only occur after rigorous verification of the source address and MAC address pairing against known trusted entries or through secure neighbor discovery protocols like SEND which use cryptographic signatures. Network administrators should also consider implementing static ARP bindings for critical infrastructure devices where feasible to prevent dynamic poisoning attacks. Additionally, deploying network intrusion detection systems capable of identifying anomalous Neighbor Advertisement traffic patterns can provide an additional layer of defense by alerting security teams to potential exploitation attempts in real-time before significant damage occurs.