open-iscsi iscsiuio: Out-of-bounds read in DHCPv4 option parser
Summary
The iscsiuio component of open-iscsi, used for iSCSI with hardware offload NICs on Red Hat Enterprise Linux, miscalculates the length of DHCPv4 option data and reads beyond a heap buffer. An attacker on the same Layer 2 network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration. According to Red Hat, systems without iSCSI offload hardware are not affected.
Affected
- Red Hat Enterprise Linux 7, 8, 9 and 10 (affected according to the CVE record; Red Hat's statuses differ across sources, verify in the advisory)
- Red Hat Enterprise Linux 6: not affected
- Only hosts with iscsiuio running, e.g. with Broadcom bnx2/bnx2x or QLogic qedi iSCSI offload NICs
Fixed in
Unknown. No fixed package version has been confirmed.
Workaround
- Restrict untrusted systems from the Layer 2 broadcast domain where iscsiuio-managed interfaces operate
- If IPv4 DHCP is not required for iSCSI boot, configure static IP addressing
- If DHCP must stay enabled, limit DHCP/BOOTP traffic so only trusted infrastructure can reach the affected host
- If iscsiuio is not needed, check whether it can be disabled after confirming the effect on your iSCSI setup
Exploitation
- No known exploitation reported; not in the CISA KEV catalog
- CISA SSVC: exploitation none, not automatable, partial technical impact
- No public proof of concept found
- EPSS around 0.002 (low)
Our recommendation
- Check whether any host runs iscsiuio or uses iSCSI boot with offload NICs (package iscsi-initiator-utils)
- Check the Red Hat CVE page and your distribution advisory for a fixed version and apply it as soon as available
- Until a fix exists, apply the Layer 2 segmentation and DHCP restrictions above
- Monitor the advisories and review network access to server VLANs
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-115484 access.redhat.com
- Red Hat Bugzilla 2556265 bugzilla.redhat.com
- OpenCVE CVE-2026-115484 app.opencve.io
- Ubuntu Security CVE-2026-115484 ubuntu.com
- NVD mirror via Vulners CVE-2026-115484 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 09:38.
Original description (NVD)
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.