CVE-2026-18725: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-18725 is an out-of-bounds write and information disclosure vulnerability in the iscsiuio component of iscsi-initiator-utils, caused by unvalidated IPv6 payload length handling in ICMPv6 Echo Request processing. Crafted ICMPv6 Echo Requests with a forged IPv6.plen field larger than the actual received payload can cause iscsiuio to perform MTU-bounded out-of-bounds reads and a potential one-byte out-of-bounds write. The affected version is iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10 on Red Hat Enterprise Linux 10. It carries a CVSS v3.1 base score of 6.3 (Medium) (Red Hat CVE, Red Hat Bugzilla). The CVE was reported on 2026-04-26 and published on 2026-08-12, with no released package fix established at time of disclosure.

The root cause is improper input validation (CWE-787: Out-of-bounds Write) in iscsiuio/src/uip/ipv6.c, specifically in the functions ipv6_icmp_handle_echo_request() and ipv6_insert_protocol_chksum(). In the echo-reply path, the code reuses the inbound ipv6_plen field directly when sizing the reply via ipv6_send() without clamping it to the actual bytes received. The checksum function similarly trusts ipv6_plen for memory traversal, and for odd forged lengths writes a single padding byte at ptr + protocol_data_len — one byte past valid protocol data. The receive-side uip_input() comparison of IPv6 payload length against uip_len is insufficient because uip_len reflects the full frame length rather than the actual IPv6 payload, and ipv6_rx_packet() does not use its len argument to bound parsing. Exploitation requires adjacent-network (L2 segment) access and the ability to send a crafted ICMPv6 Echo Request with a forged IPv6.plen; no authentication or user interaction is needed (Red Hat Bugzilla).

Successful exploitation can result in limited confidentiality loss (out-of-bounds reads may expose data beyond the valid packet boundary in the reply or checksum path), limited integrity impact (a one-byte out-of-bounds write may corrupt adjacent buffer contents), and limited availability impact (invalid memory access may destabilize or crash the iscsiuio process). The impact is constrained to the iscsiuio process and its packet buffer handling, and is MTU-bounded rather than arbitrary. Red Hat classifies the overall severity as Moderate, noting that while the flaw is unauthenticated and adjacent-network reachable, it does not readily enable remote system compromise or high-impact memory corruption (Red Hat Bugzilla, Red Hat CVE).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-18725. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is limited to attackers on the same L2 network segment as a system running iscsiuio with IPv6/NDP active on a reachable interface. The Nessus plugin 334996 has been published to detect the affected package (Tenable). No EPSS score or threat actor attribution is currently available.

1. Reconnaissance: Identify systems on the same L2 network segment running iscsiuio (part of iscsi-initiator-utils) with IPv6/NDP active on a reachable interface. This can be done by observing NDP/ICMPv6 traffic or scanning for iSCSI-related services.
2. Craft malicious ICMPv6 Echo Request: Using a packet crafting tool such as Scapy, construct an ICMPv6 Echo Request with the IPv6.plen field set to a value larger than the actual payload bytes in the frame — for example, plen=1491 with an Ethernet frame near 1500 bytes.
3. Send the crafted packet: Transmit the forged packet directly to the target interface on the same L2 segment. No authentication or prior session is required.
4. Trigger out-of-bounds access: iscsiuio processes the packet in ipv6_icmp_handle_echo_request(), trusts the inflated ipv6_plen, and passes it to ipv6_send() and ipv6_insert_protocol_chksum(), causing out-of-bounds reads (and potentially a one-byte write for odd lengths) in the packet buffer.
5. Observe results: The echo reply may contain data beyond the valid packet boundary (information disclosure), adjacent buffer contents may be corrupted (integrity impact), or the iscsiuio process may crash (availability impact) (Red Hat Bugzilla).

• Network: Unexpected or malformed ICMPv6 Echo Request packets on iSCSI network segments with IPv6.plen values significantly larger than the actual frame payload; ICMPv6 Echo Replies from iscsiuio-managed interfaces containing data beyond expected payload boundaries.
• Process: Unexpected crashes or restarts of the iscsiuio process; ASAN (AddressSanitizer) reports of invalid memory access in ipv6_insert_protocol_chksum() or ipv6_icmp_handle_echo_request() if built with sanitizers enabled.
• Logs: System logs (/var/log/messages, journal) showing iscsiuio process termination or segmentation faults; kernel or application logs indicating memory access violations in the iSCSI userspace I/O daemon (Red Hat Bugzilla).

No released package fix has been established as of the disclosure date; upstream coordination had not yet occurred at time of reporting. The proposed fix involves clamping the reply payload length to the actual received payload derived from context->ustack->uip_len, rejecting packets too short to contain a complete ICMPv6 header, and rewriting ipv6->ipv6_plen before calling ipv6_send() — a patch diff is included in the Red Hat Bugzilla report. As interim mitigations: restrict iscsiuio-managed interfaces to trusted L2 segments only; disable IPv6 on those interfaces where operationally acceptable; or filter ICMPv6 Echo Requests before they reach iscsiuio. If iscsiuio is not processing IPv6/NDP traffic, the vulnerable code path is not reachable (Red Hat Bugzilla, Red Hat CVE).

Red Hat has classified the vulnerability as Moderate severity and noted that operators can reduce exposure by isolating or disabling the affected IPv6/NDP path. The bug was acknowledged to Aisle Research as the discovering party. No significant broader media coverage, researcher commentary, or social media discussion has been identified at this time (Red Hat Bugzilla).