CVE-2026-18724: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-18724 is a stack-based buffer overflow vulnerability in the idbm_recinfo_config() function of iscsi-initiator-utils, affecting version 6.2.1.11-0.git4b3e853.el10 on Red Hat Enterprise Linux 10. An attacker who controls or can intercept iSCSI SendTargets discovery traffic can craft a malicious TargetName containing a newline and oversized key/value data, injecting a rogue configuration line into a persisted node record that later triggers a stack buffer overflow during reparsing. The CVE was reported on 2026-04-26 and published on 2026-08-12, with no released package fix as of the time of writing. It carries a CVSS v3.1 base score of 7.5–7.6 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a CWE-121 (Stack-based Buffer Overflow) in usr/idbm.c:idbm_recinfo_config(), where config keys and values are copied into fixed 128-byte and 256-byte stack buffers respectively without bounds checking. During SendTargets discovery, attacker-controlled TargetName text is accepted up to TARGET_NAME_MAXLEN (255 bytes) and written to disk without filtering control characters; a TargetName embedding a newline (e.g., iqn.test AAAA...=B) splits the serialized node.name entry and injects a second config line. When the saved node record is later reread — during discovery update, node update, or login — the oversized injected key (>128 bytes) or value (>256 bytes) overflows the stack buffers in idbm_recinfo_config(). The attack chain spans usr/discovery.c (SendTargets handling and add_target_record()) and usr/idbm.c (record serialization and reparsing) (Red Hat Bugzilla).

Successful exploitation can crash the iSCSI initiator service (denial of service) and potentially corrupt process memory, with limited confidentiality and integrity impact from memory exposure. The most clearly supported outcome is a crash during config reparsing; reliable arbitrary code execution is considered plausible but not yet demonstrated. Red Hat rates the overall impact as Moderate due to the multi-step exploitation workflow and the absence of proven code execution (Red Hat Bugzilla, Red Hat CVE).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the disclosure date. The CVE status remains "Reserved" and no CISA KEV listing has been identified. Exploitation requires a multi-step workflow: the attacker must control or intercept iSCSI discovery traffic, the victim must run persistent SendTargets discovery, and a subsequent node-record operation must be triggered — raising the practical bar despite the network-accessible attack vector (Red Hat Bugzilla, Tenable).

1. Set up a malicious iSCSI target or perform a man-in-the-middle attack: Position the attacker to respond to iSCSI SendTargets discovery requests from the victim initiator, either by running a rogue iSCSI target on the same network segment or by intercepting/tampering with discovery traffic.
2. Craft a malicious TargetName response: Return a TargetName value that contains a newline character followed by an oversized key or value, for example: TargetName=iqn.test\nAAAAAAAA...(>=129 chars)=B. The total length must stay within TARGET_NAME_MAXLEN (255 bytes) while still embedding the newline and oversized injected segment.
3. Trigger persistent SendTargets discovery on the victim: The victim runs iscsiadm -m discovery -t sendtargets -p <attacker-IP> in default (persistent) mode. The malicious TargetName is accepted and the node record — including the injected line — is written to disk.
4. Verify record injection: Inspect the saved node record file to confirm it contains both the expected node.name = ... line and the injected AAAA...=B line.
5. Trigger a node-record reread: Cause the victim to perform any operation that rereads the saved record, such as a discovery update, node update (iscsiadm -m node --op update), or login (iscsiadm -m node --login). The idbm_recinfo_config() function parses the injected oversized key/value, overflowing the 128-byte or 256-byte stack buffer and causing a crash or memory corruption (Red Hat Bugzilla).

• Network: Unexpected or unsolicited iSCSI SendTargets responses from unknown IP addresses; iSCSI discovery traffic to/from untrusted network segments.
• File System: Node record files in the iSCSI database directory (typically /var/lib/iscsi/nodes/) containing lines with non-printable characters, newlines embedded in node.name values, or unusually long key/value entries exceeding 128/256 characters.
• Logs: iSCSI initiator log entries (/var/log/messages or journalctl -u iscsid) showing parsing errors, warnings about malformed config lines, or crashes in idbm_recinfo_config(); segmentation fault or abort signals from the iscsid or iscsiadm process.
• Process: Unexpected termination or crash of iscsid daemon following a discovery or node-record operation; core dump files generated by iscsid or iscsiadm (Red Hat Bugzilla).

No released package fix is currently available for iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10; a proposed patch exists in the Red Hat Bugzilla report that adds bounds checks to idbm_recinfo_config() and rejects control characters in TargetName before persistence. Until an official fix is released, Red Hat recommends avoiding persistent SendTargets discovery against untrusted or interceptable networks, using nonpersistent discovery mode where operationally acceptable, and removing node records created from untrusted discovery results before performing update or login operations. Additionally, restrict iSCSI discovery traffic to trusted, segmented networks and monitor initiator logs for abnormal SendTargets responses (Red Hat Bugzilla, Red Hat CVE).

The vulnerability was credited to Aisle Research in the Red Hat Bugzilla report. Red Hat assessed the impact as Moderate rather than Important, citing the multi-step exploitation requirements and the absence of demonstrated code execution. The bug was filed under embargo review but Red Hat determined embargoed handling was not necessary given the exploitation complexity. No significant broader media coverage or social media discussion has been identified at this time (Red Hat Bugzilla).