CVE-2026-14258: dhcpcd IPv6 Router Advertisement Parser DoS Vulnerability

Technical summary

The vulnerability exists in dhcpcd's Neighbor Discovery Router Advertisement parsing logic. During initial packet storage, a zero-length Neighbor Discovery option passes validation that should reject it. When the packet is later reparsed, the parser does not properly validate the option length, causing it to enter a non-advancing parsing loop. The loop consumes CPU cycles without progressing through the packet structure, leading to resource exhaustion on the affected host. This is classified under CWE-835 (Loop with Unreachable Exit Condition).

Business impact

Organizations running dhcpcd on network-connected Linux systems face availability risk. An attacker positioned on the local network (able to send Layer 2 frames or within the same routing domain) can disrupt DHCP client functionality by triggering the denial-of-service condition. In environments where dhcpcd runs on routers, edge devices, or servers handling IPv6 traffic, a successful attack can degrade or eliminate network connectivity until manual intervention restarts the service. This is particularly relevant for organizations operating dual-stack networks or relying on IPv6 autoconfiguration.

Affected systems

dhcpcd is affected. The source data does not specify which versions are vulnerable; consult the dhcpcd project advisories and your vendor's security bulletins to identify the exact version ranges requiring patching. Systems running dhcpcd on Linux distributions (especially those using it as the default DHCP client) and network appliances bundling dhcpcd are in scope.

Exploitability

Exploitation requires network-adjacent access (AV:A); the attacker must be able to transmit IPv6 packets on the same network segment as the target. No special privileges are needed on the target system, and user interaction is not required. Attack complexity is low—the attacker simply needs to craft and send one malicious Router Advertisement packet. The barrier to exploitation is moderate due to the requirement for network adjacency, but once positioned, the attack is trivial to execute and highly reliable.

Remediation

Apply security patches released by the dhcpcd project as soon as they become available. Patches will address validation logic to properly reject or safely handle zero-length Neighbor Discovery options and prevent parser loops during reparsing. Until patches are deployed, operational mitigations include restricting Router Advertisement sources via firewall rules (if applicable to your network architecture) or disabling IPv6 on systems that do not require it. Restart the dhcpcd daemon after patching to ensure the updated code is running.

Patch guidance

Monitor the dhcpcd project repository and your Linux distribution's security advisories for patch releases addressing CVE-2026-14258. Verify patch applicability against your dhcpcd version before deployment. Test patches in a staging environment to confirm they resolve the parser issue without introducing regressions in IPv6 configuration. Coordinated rolling deployment across your infrastructure minimizes downtime. After patching, confirm dhcpcd is running the updated binary and validate that IPv6 Router Advertisement processing continues to function normally.

Detection guidance

Monitor system processes for sustained high CPU usage by the dhcpcd daemon, especially if coupled with IPv6 network activity from untrusted sources. Log and analyze any malformed or unusual IPv6 Router Advertisement packets received on monitored interfaces using packet capture tools (tcpdump, Wireshark). Check dhcpcd debug logs (if enabled) for parsing errors or unexpected loops during Router Advertisement processing. Network intrusion detection systems (NIDS) can be tuned to flag Router Advertisements with zero-length options originating from unexpected sources. Host-based process monitoring can trigger alerts when dhcpcd CPU usage exceeds normal baselines for extended periods.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS 6.5 MEDIUM score reflects high availability impact but limited confidentiality or integrity risk. Prioritize patching systems in environments where IPv6 is actively used and where network adjacency attacks are realistic (internal LANs, cloud environments, or data centers with untrusted tenants). Systems in isolated or IPv4-only networks face lower risk. The lack of active exploitation in the wild (KEV status: not listed) suggests this is not yet a widespread threat, but the ease of exploitation once positioned argues for proactive patching within a normal maintenance window.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects a network-adjacent attack vector with low complexity, no privilege escalation required, and a high impact on availability. The score does not account for business context (e.g., whether your systems rely on IPv6, network segmentation, or are internet-facing). Organizations with mature network segmentation and IPv4-only deployments may rate this lower; those with dual-stack networks and permissive internal routing should rate it higher.

Frequently asked questions