{"id":"CVE-2026-115486","title":"Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning","summary":"A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated uncond…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","cvssSource":"cna","cwe":["CWE-125"],"vendor":"Red Hat","product":"iscsi-initiator-utils","affected":["iscsi-initiator-utils (all versions)","iscsi-initiator-utils","iscsi-initiator-utils (all versions)","iscsi-initiator-utils (all versions)","iscsi-initiator-utils (all versions)"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T00:16:34.250Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115486","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-115486"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556267","label":"RHBZ#2556267"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T01:11:52.505Z","slug":"CVE-2026-115486","body":"## Overview\n\nA flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.\n\n## Affected\n\n- `iscsi-initiator-utils (all versions)`\n- `iscsi-initiator-utils`\n- `iscsi-initiator-utils (all versions)`\n- `iscsi-initiator-utils (all versions)`\n- `iscsi-initiator-utils (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nKeep iscsiuio-managed interfaces on trusted L2 segments only. Where operationally acceptable, filter ICMPv6 Neighbor Advertisement (type 136) and Neighbor Solicitation (type 135) messages from untrusted sources using firewall rules.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}