CVE-2026-18726 is a moderate severity vulnerability in open-iscsi's iscsiuio daemon. It allows an attacker on the same local network segment to cause a denial of service by sending a specially crafted ICMPv6 Router Advertisement containing a zero-length option. This input triggers an infinite loop in the daemon, resulting in sustained CPU consumption and unresponsiveness, impacting system availability. Additionally, there is a secondary risk of out-of-bounds reads from short IPv6 payloads, though no memory corruption or data leakage has been confirmed. The vulnerability is classified under CWE-835 (Infinite Loop). Exploitation requires the attacker to be on the same Layer 2 network segment as an IPv6-enabled interface handled by iscsiuio, limiting the attack surface. No known exploits in the wild have been reported. The vulnerability has a CVSS v3.1 base score of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Successful exploitation leads to a denial of service condition by causing the iscsiuio daemon to enter an infinite loop, resulting in high CPU usage and unresponsiveness. This impacts system availability but does not affect confidentiality or integrity. The attack requires network adjacency and IPv6 enabled on the target interface. There is no confirmed memory corruption or data exposure.

No official patch is currently confirmed. To mitigate this issue, restrict ICMPv6 Router Advertisements from untrusted sources on any network segment where iscsiuio interfaces are exposed. Alternatively, disable IPv6 Router Advertisement processing on affected interfaces if it is not operationally required. This can be achieved by configuring firewall rules to filter ICMPv6 type 134 messages or adjusting network interface settings to prevent RA-driven IPv6 configuration. A restart of the iscsiuio service may be required for changes to take effect.