CVE-2026-18726 Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing

Medium 6.5 Published 12 Aug 2026 Updated 18 Aug 2026

Remote attackers can cause a denial of service in the iscsiuio daemon by sending crafted ICMPv6 Router Advertisements, leading to infinite loops and high CPU usage.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-18726?

CVE-2026-18726 is a medium-severity denial of service vulnerability in Redhat Enterprise Linux, published on 12 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.

Weakness: CWE-835

Which versions are affected by CVE-2026-18726?

It affects 1 product.

Products include Redhat Enterprise Linux.

How do I fix CVE-2026-18726?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-18726 being exploited?

There is no known exploitation of CVE-2026-18726 in the wild and no public exploit code.

All Redhat Enterprise Linux vulnerabilities

Sources

Also known as AZL-95925, DEBIAN-CVE-2026-18726, GHSA-q9p8-qgxc-hw66, UBUNTU-CVE-2026-18726.