This vulnerability exists in the iscsiuio component of open-iscsi used in Red Hat Enterprise Linux 10. It is caused by an integer underflow during DHCPv6 packet parsing when processing crafted DHCPv6 Advertise traffic with a short UDP length. This underflow leads to an out-of-bounds read, which can cause the iscsiuio process to crash or the service to be disrupted, resulting in a denial of service. Exploitation requires an attacker on the same adjacent network segment to send specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange. The flaw is classified as CWE-191 (Integer Underflow).

The vulnerability can cause a denial of service by crashing the iscsiuio process or disrupting the DHCPv6 client service. There is no impact on confidentiality or integrity. Exploitation is limited to attackers on the same Layer 2 network segment and requires the client to be actively performing DHCPv6 exchanges. No known exploits in the wild have been reported.

If DHCPv6 is not required for iscsiuio, disable DHCPv6 handling on the relevant network interface. If DHCPv6 is necessary, restrict network exposure to trusted adjacent networks and implement firewall rules to block forged DHCPv6 server traffic on shared Layer 2 segments. A system restart or service reload may be required for these changes to take effect. Patch status is not yet confirmed — check the Red Hat advisory for updates: https://access.redhat.com/security/cve/CVE-2026-18727