CVE-2026-55995: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-55995 is a Double Free vulnerability in open-iscsi's open-isns component that allows an unauthenticated man-in-the-middle (MITM) attacker to cause a Denial of Service (DoS). The vulnerability affects open-iscsi versions up to and including commit 56718d4e9d1a4f51c30697b5c0534144bb41c9bb. It was published on July 29, 2026, and assigned by SUSE. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is a double free condition (CWE-415) combined with a release of an invalid pointer or reference (CWE-763) in attrs.c within the open-isns library. Specifically, in the isns_attr_type_string_decode() and isns_attr_type_opaque_decode() functions, when buf_get() fails during attribute decoding, allocated memory is freed but the pointer is not set to NULL. This leaves a dangling pointer that can be freed again in a subsequent error-handling path. An unauthenticated attacker positioned as a MITM on the network can craft malicious iSNS protocol messages to trigger this error path, causing the open-iscsi service to crash (GitHub Commit).

Successful exploitation results in a crash of the open-iscsi/open-isns service, causing a Denial of Service condition that makes iSCSI storage connectivity unavailable to legitimate users and systems. There is no impact on confidentiality or integrity — only availability is affected. In environments relying on iSCSI for networked storage (e.g., SAN-attached workloads, virtual machine datastores), a crash could disrupt storage access for dependent systems, potentially causing broader service outages (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of publication (GitHub Advisory). The NVD SSVC assessment notes the vulnerability is automatable (no user interaction required) but has only partial technical impact. The EPSS score is approximately 0.0025 (0.25%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a network-adjacent MITM position, which limits the attack surface compared to fully remote vulnerabilities.

1. Gain MITM Position: Position on the network path between an iSCSI initiator and the iSNS server (e.g., via ARP spoofing, rogue DHCP, or compromised network infrastructure) to intercept and modify iSNS protocol traffic.
2. Craft Malicious iSNS Message: Construct a malformed iSNS attribute message that causes buf_get() to fail during decoding of a string or opaque attribute in attrs.c, triggering the error path in isns_attr_type_string_decode() or isns_attr_type_opaque_decode().
3. Inject Malformed Packet: Inject the crafted packet into the iSNS communication stream, causing the open-isns service to free the allocated memory and then attempt to free the same pointer again (double free).
4. Trigger DoS: The double free corrupts the heap and causes the open-isns daemon to crash, disrupting iSCSI service discovery and connectivity for all dependent initiators (GitHub Commit).

• Network: Unexpected or malformed iSNS protocol packets (TCP port 3205) on the network; unusual traffic patterns between iSCSI initiators and the iSNS server from unexpected source IPs.
• Logs: Crash logs or core dumps from the isns or open-isns daemon; system logs (e.g., /var/log/syslog, /var/log/messages) showing segmentation faults or heap corruption errors related to the isns process.
• Process: Unexpected termination or restart of the isnsd daemon; monitoring alerts for the open-isns service going down repeatedly.

The fix is available in the open-isns repository at commit 56718d4e9d1a4f51c30697b5c0534144bb41c9bb, which sets freed pointers to NULL in the error paths of attrs.c to prevent the double free (GitHub Commit). Red Hat has released a security errata (RHSA-2026:53848) addressing this issue for affected RHEL packages (Red Hat Errata). Microsoft has also issued guidance for Azure Linux 3 (AZL3) packages isns-utils 0.102-1 and 0.102-2 (Microsoft MSRC). As a workaround, implement network segmentation to restrict who can intercept iSNS traffic, and consider using CHAP authentication or encrypted iSCSI connections to reduce MITM attack surface.

Coverage has been primarily limited to vendor advisories and security tracking platforms. Red Hat, AlmaLinux, Oracle Linux, and Microsoft Azure Linux have all issued patches or advisories. A Windows forum post noted the fix is specific to Linux iSNS utilities and does not affect Windows iSCSI implementations (Windows Forum). Pro-Linux.de covered the vulnerability in the context of isns-utils security updates for Linux distributions (Pro-Linux). No significant researcher commentary or social media discussion has been observed.