CVE-2026-18726 is a vulnerability in Red Hat Enterprise Linux (RHEL)
Published on August 12, 2026
Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing
A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.
Vulnerability Analysis
Timeline
Reported to Red Hat.
Made public. 108 days later.
Weakness Type
What is an Infinite Loop Vulnerability?
The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
CVE-2026-18726 has been classified to as an Infinite Loop vulnerability or weakness.
Products Associated with CVE-2026-18726
Want to know whenever a new CVE is published for Red Hat Enterprise Linux (RHEL)? stack.watch will email you.