The vulnerability exists in the iscsiuio component of open-iscsi. Its IPv6 Neighbor Discovery handler reads link-layer address options at a fixed offset without first validating the packet’s contents. Because the ARP table is always updated with the address extracted from the packet, an attacker on the same local network segment can send a minimal Neighbor Advertisement that contains a forged link-layer address. The kernel will then replace the legitimate entry in the ARP table with the attacker’s address, effectively poisoning the ARP cache. This allows the attacker to redirect, intercept or drop traffic destined for other hosts, and makes the network susceptible to man‑in‑the‑middle attacks. The weakness is classified as CWE‑125 (Buffer Overread) and is rated with a CVSS score of 7.1.

The flaw affects Red Hat Enterprise Linux releases 10, 6, 7, 8, and 9 that include the open‑iscsi package, specifically the iscsiuio kernel module. No specific revision numbers are listed in the CNA data, so any installation of the affected open‑iscsi component on the aforementioned operating systems is potentially vulnerable unless patched by the vendor.

With a CVSS base score of 7.1 the vulnerability denotes a medium to high severity. The EPSS score is not available, and the issue is not yet cataloged in CISA’s KEV list, suggesting moderate exploitation probability at the present time. However, the attack vector is local network based: an attacker only needs to be on the same Layer‑2 segment and send an appropriately crafted Neighbor Advertisement. Because the exploit requires no authentication or elevated privileges, the risk of successful traffic injection or redirection is significant for untrusted or poorly segmented networks.