A flaw in open-iscsi allows a remote attacker on the same local network segment to send a specially crafted ICMPv6 Router Advertisement with a zero‑length option, causing the iscsiuio daemon to enter an infinite loop. This results in sustained high CPU usage, rendering the daemon unresponsive and impacting system availability. The vulnerability is described as a runtime error that can lead to performance degradation and potential out‑of‑bounds reads, though no memory corruption has been confirmed. The weakness corresponds to CWE‑835, which indicates a loop or counter synchronization error.

The vulnerability affects Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 systems that run the open‑iscsi package. The iscsiuio daemon on those operating systems is the component impacted. No specific software version numbers are given, so any installation of open‑iscsi on the supported RHEL releases is considered exposed.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is from a remote host within the same local network segment, requiring the ability to send ICMPv6 Router Advertisement messages to the target machine. An attacker who can do so can trigger the denial of service without needing higher privileges or internet connectivity. Because the exploit relies on manipulating normal network traffic, it can be performed by a host that can send IP packets to the target.