Log in Start free

Vulnerability · Published Oct 23, 2026 · Assigned by redhat

CVE-2026-115486Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning

High 7.1

In plain English

A high-severity out-of-bounds read in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.2%top 89.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12open-iscsino fix listedDEBIAN-CVE-2026-115486
Debian:13open-iscsino fix listedDEBIAN-CVE-2026-115486
Debian:14open-iscsino fix listedDEBIAN-CVE-2026-115486
Ubuntu:22.04:LTSopen-iscsino fix listedUBUNTU-CVE-2026-115486
Ubuntu:24.04:LTSopen-iscsino fix listedUBUNTU-CVE-2026-115486
Ubuntu:26.04:LTSopen-iscsino fix listedUBUNTU-CVE-2026-115486
Ubuntu:26.10open-iscsino fix listedUBUNTU-CVE-2026-115486

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-125 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

References