CVE-2026-115485: Out-of-bounds Read in Red Hat Red Hat Enterprise Linux 10

The vulnerability in Red Hat Enterprise Linux 10's open-iscsi iscsiuio component arises because the DHCPv6 option parser uses strlen() on unverified raw network data, which may lack a terminating NUL byte. This results in out-of-bounds reads beyond the buffer into heap memory. Consequences include daemon crashes, a one-byte heap overwrite, or corruption of the iSCSI initiator name. Exploitation requires network proximity, as an attacker must send a specially crafted DHCPv6 Advertise message to trigger the flaw.

Successful exploitation can lead to denial of service via daemon crashes, minor heap memory corruption, and potential integrity issues with the iSCSI initiator name. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector (C:L/I:L/A:L). No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-115485 for current remediation guidance. Until a fix is applied, limit network exposure to untrusted DHCPv6 servers and monitor network segments for suspicious DHCPv6 Advertise messages.