CVE-2026-115486
Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
- Record
CVE-2026-115486- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-125
- Updated
- 2026-11-05
EUVDEUVD-2026-108557
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
- Record
EUVD-2026-108557- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-9f4r-jjqf-4v98
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler...
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
- Record
GHSA-9f4r-jjqf-4v98- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
- Record
CVE-2026-115486- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Weakness
- CWE-125
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-115486
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
- Record
DEBIAN-CVE-2026-115486- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Updated
- 2026-11-03
OSVUBUNTU-CVE-2026-115486
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
- Record
UBUNTU-CVE-2026-115486- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L - Updated
- 2026-11-02
OSVAZL-111392 No score
CVE-2026-115486 affecting package iscsi-initiator-utils 2.1.12-1
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
- Record
AZL-111392- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iscsi-initiator-utilsAzure Linux:3 |
through 2.1.12-1 | None known |
open-iscsiDebian:12 |
All versions, plus listed versions 2.1.10-12.1.10-22.1.10-32.1.11-12.1.11-2 Show 14 moreShow less2.1.11-32.1.11-42.1.11-52.1.11-62.1.12-12.1.12-22.1.13-12.1.8-12.1.8-1+deb12u12.1.8-22.1.9-12.1.9-22.1.9-32.1.9-4 |
None known |
open-iscsiDebian:13 |
All versions, plus listed versions 2.1.11-12.1.11-1+deb13u12.1.11-1+deb13u22.1.11-22.1.11-3 Show 6 moreShow less2.1.11-42.1.11-52.1.11-62.1.12-12.1.12-22.1.13-1 |
None known |
open-iscsiDebian:14 |
All versions, plus listed versions 2.1.11-12.1.11-22.1.11-32.1.11-42.1.11-5 Show 4 moreShow less2.1.11-62.1.12-12.1.12-22.1.13-1 |
None known |
open-iscsiUbuntu:14.04:LTS |
All versions, plus listed versions 2.0.873-3ubuntu72.0.873-3ubuntu82.0.873-3ubuntu9 |
None known |
open-iscsiUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.0.873-3ubuntu132.0.873+git0.3b4b4500-13ubuntu32.0.873+git0.3b4b4500-14ubuntu12.0.873+git0.3b4b4500-14ubuntu32.0.873+git0.3b4b4500-14ubuntu3.1 Show 7 moreShow less2.0.873+git0.3b4b4500-14ubuntu3.22.0.873+git0.3b4b4500-14ubuntu3.32.0.873+git0.3b4b4500-14ubuntu3.42.0.873+git0.3b4b4500-14ubuntu3.52.0.873+git0.3b4b4500-14ubuntu3.62.0.873+git0.3b4b4500-14ubuntu3.72.0.873+git0.3b4b4500-14ubuntu3.7+esm1 |
None known |
open-iscsiUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.0.874-4ubuntu32.0.874-4ubuntu42.0.874-4ubuntu52.0.874-5ubuntu12.0.874-5ubuntu2 Show 10 moreShow less2.0.874-5ubuntu2.12.0.874-5ubuntu2.22.0.874-5ubuntu2.32.0.874-5ubuntu2.42.0.874-5ubuntu2.62.0.874-5ubuntu2.72.0.874-5ubuntu2.92.0.874-5ubuntu2.102.0.874-5ubuntu2.112.0.874-5ubuntu2.11+esm1 |
None known |
open-iscsiUbuntu:20.04:LTS |
All versions, plus listed versions 2.0.874-7.1ubuntu32.0.874-7.1ubuntu52.0.874-7.1ubuntu62.0.874-7.1ubuntu6.12.0.874-7.1ubuntu6.22.0.874-7.1ubuntu6.32.0.874-7.1ubuntu6.42.0.874-7.1ubuntu6.5 |
None known |
open-iscsiUbuntu:22.04:LTS |
All versions, plus listed versions 2.1.4-0ubuntu12.1.4-0ubuntu22.1.4-0ubuntu32.1.4-0ubuntu42.1.5-1ubuntu12.1.5-1ubuntu1.12.1.5-1ubuntu1.3 |
None known |
open-iscsiUbuntu:24.04:LTS |
All versions, plus listed versions 2.1.8-1ubuntu22.1.9-3ubuntu12.1.9-3ubuntu22.1.9-3ubuntu32.1.9-3ubuntu4 Show 5 moreShow less2.1.9-3ubuntu5.12.1.9-3ubuntu5.22.1.9-3ubuntu5.32.1.9-3ubuntu5.42.1.9-3ubuntu5.5 |
None known |
open-iscsiUbuntu:26.10 |
All versions, plus listed versions 2.1.11-3ubuntu32.1.11-5ubuntu12.1.11-5ubuntu42.1.11-5ubuntu52.1.11-5ubuntu6 |
None known |
open-iscsiUbuntu:26.04:LTS |
All versions, plus listed versions 2.1.11-1ubuntu32.1.11-3ubuntu12.1.11-3ubuntu22.1.11-3ubuntu32.1.11-3ubuntu3.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | CVE List, EUVD, NVD, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-115486 is a high vulnerability (CVSS 7.1) in Red Hat Enterprise Linux 10, published October 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. No source names a fixed version.