Double-free Vulnerability in open-iscsi iSNS Attribute Decoder

The open-iscsi package contains a double-free vulnerability (CVE-2026-55995) located within its iSNS (Internet Storage Name Service) attribute decoder. A double-free occurs when an application attempts to free memory that has already been deallocated, which can lead to heap corruption and potentially allow an attacker to trigger an application crash or execute arbitrary code under specific conditions. This vulnerability impacts systems utilizing open-iscsi for iSCSI target and initiator connectivity. Defenders should prioritize patching systems running vulnerable versions of open-iscsi to mitigate the risk of denial-of-service or potential exploitation.

Impact

The vulnerability potentially allows for application instability, memory corruption, or service denial of the iSCSI service. If successfully exploited, this could disrupt storage connectivity for services relying on iSCSI, impacting enterprise infrastructure that depends on network-attached storage or storage area networks (SAN).

Recommendation

• Upgrade the open-iscsi package to the latest version provided by the distribution vendor to remediate CVE-2026-55995.
• Review package management logs or inventory tools to identify systems running older versions of open-iscsi.
• Monitor for unexpected service restarts of the open-iscsi daemon, as this may indicate an attempt to trigger the vulnerability or general instability.