Executive brief
open-iscsi is a utility for managing iSCSI network storage connections on Linux systems. A flaw in the iscsiuio daemon allows an attacker on the same local network to send a crafted IPv6 Router Advertisement message that triggers an infinite loop, consuming CPU resources and making the daemon unresponsive. This impacts system availability for any infrastructure relying on iSCSI storage connectivity.
Technical details
This vulnerability is an infinite loop (CWE-835) in open-iscsi's iscsiuio daemon when parsing specially crafted ICMPv6 Router Advertisement packets with zero-length options. The attack requires network adjacency (same Layer 2 segment) and an IPv6-enabled interface, but no authentication or user interaction. A successful exploit causes sustained CPU consumption, rendering the daemon unresponsive and degrading system availability. A secondary risk of out-of-bounds reads exists with short IPv6 payloads, though no confirmed memory corruption or data exposure has been observed. Mitigation involves filtering ICMPv6 type 134 messages or disabling IPv6 RA processing on affected interfaces.
Affected products
- open-iscsi open-iscsi
Timeline
- 2026-08-12: disclosed