Executive brief
A vulnerability in the open-iscsi software suite could allow a remote attacker to crash the service, leading to a denial-of-service. This software is commonly used to connect Linux systems to network-based storage (SANs). An exploit would disrupt the connection between servers and their storage disks, potentially halting business operations and data access.
Technical details
A double-free vulnerability exists in the open-isns component of open-iscsi within the attrs.c file. The flaw is located in the error handling paths of isns_attr_type_string_decode and isns_attr_type_opaque_decode; when buf_get() fails, the allocated memory is freed but the pointer is not set to NULL, leading to a subsequent free of the same memory address. An unauthenticated attacker positioned as a Man-in-the-Middle (MITM) can trigger this condition to cause a crash (Denial of Service). The issue is addressed in commit 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.
Affected products
- open-iscsi open-iscsi up to commit 56718d4e9d1a4f51c30697b5c0534144bb41c9bb
- open-iscsi open-isns up to commit 56718d4e9d1a4f51c30697b5c0534144bb41c9bb
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory
- 2026-07-29: patched: Fix committed to open-isns repository