A flaw was found in dhcpcds IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.
Weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | RedHat | dhcpcd-0:10.0.6-11.el10_2 | * |
| Dhcpcd | Ubuntu | questing | * |
References
- https://access.redhat.com/errata/RHSA-2026:54210
- https://access.redhat.com/security/cve/CVE-2026-14258
- https://bugzilla.redhat.com/show_bug.cgi?id=2462305
- https://github.com/NetworkConfiguration/dhcpcd/commit/75289ca
- https://github.com/NetworkConfiguration/dhcpcd/issues/415
- https://github.com/NetworkConfiguration/dhcpcd/issues/415