CVE-2026-56113: dhcpcd Heap Use-After-Free Denial of Service

Technical summary

The vulnerability is a classic heap use-after-free in dhcpcd's IPv6 prefix delegation handling. When processing a DHCPv6 RENEW reply containing RFC 6603 OPTION_PD_EXCLUDE with both preferred and valid lifetimes zeroed, dhcpcd calls dhcp6_deprecatedele() to mark a delegated child address for removal. However, dhcp6_deprecateaddrs() iterates over the address list using TAILQ_FOREACH_SAFE while this deletion occurs, and the freed pointer remains in the iterator's internal state. When TAILQ_REMOVE is subsequently called, it dereferences the stale pointer, triggering undefined behavior. The condition AC:H (attack complexity high) reflects the requirement that an attacker must be on the same link and craft a specific DHCPv6 message structure.

Business impact

Affected organizations experience denial of service on systems running vulnerable dhcpcd instances. Since dhcpcd is the primary DHCP client on many Linux distributions and embedded systems (routers, IoT devices, containers), a crash causes immediate network unavailability until manual restart. In infrastructure contexts—particularly virtualized environments, edge devices, or remote systems—this creates operational disruption and potential cascading failures. The attack surface includes any network where an attacker can impersonate or compromise a DHCPv6 server, which may be lower in well-segmented corporate networks but higher in multi-tenant cloud, shared hosting, or home/small office environments.

Affected systems

dhcpcd project dhcpcd through version 10.3.2 is vulnerable. This includes all Linux distributions and embedded systems that bundle dhcpcd as their primary DHCP client. Notable affected categories include Alpine Linux, various embedded routers, container base images, and network appliances. Users should verify their installed version and check whether their distribution has already patched.

Exploitability

Exploitation requires network access on the same link segment (AV:A) and the ability to send DHCPv6 messages, typically by being a DHCPv6 server or via ARP/IPv6 spoofing. The attack complexity is rated high (AC:H), meaning an attacker must craft a precise DHCPv6 frame with both RFC 6603 option and specific zero-valued lifetime fields. No user interaction is required. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code has been documented as of the vulnerability's publication date.

Remediation

Update dhcpcd to a patched version released after commit 5733d3c. Most Linux distributions have already issued updates; check your distribution's security advisories. For systems where dhcpcd cannot be immediately updated, network-level mitigations include: restricting DHCPv6 traffic to trusted servers, disabling prefix delegation on untrusted networks if not required, and implementing network segmentation to isolate systems from potentially compromised DHCPv6 servers. These are temporary measures pending patches.

Patch guidance

Identify your dhcpcd version using 'dhcpcd --version' or 'dhcpcd -v'. If running 10.3.2 or earlier, obtain the latest version from your distribution's package manager (e.g., 'apt update && apt upgrade dhcpcd' on Debian-based systems, 'apk upgrade dhcpcd' on Alpine). Verify the patched version is newer than 10.3.2. For systems using custom or upstream builds, pull from the official dhcpcd repository and build commit 5733d3c or later. Restart the dhcpcd service after installation: 'systemctl restart dhcpcd' or equivalent for your init system. Test connectivity immediately post-restart.

Detection guidance

Monitor system logs for dhcpcd crashes, particularly segmentation faults or SIGSEGV signals coinciding with unusual DHCPv6 traffic. Enable dhcpcd debug logging (typically via '-d' flag or configuration) on test systems to capture detailed DHCP message flows. Network-level detection is challenging without packet inspection for the specific malformed DHCPv6 RENEW with OPTION_PD_EXCLUDE; however, unexplained daemon crashes following DHCPv6 server communication patterns may warrant deeper packet capture analysis. Host-based intrusion detection focused on dhcpcd process crashes and abnormal termination provides practical alerting.

Why prioritize this

Despite CVSS 5.3 (medium), this vulnerability warrants moderate-to-high priority because dhcpcd is pervasive in Linux and embedded systems, and denial of service on network infrastructure has immediate operational impact. The attack vector is local to the network link, limiting exposure in enterprise networks but creating significant risk for home users, IoT deployments, and data centers with less-controlled upstream network segments. The lack of KEV designation and public exploits suggests active exploitation is not yet widespread, but the technical simplicity of crafting the malformed DHCPv6 message means exploitation could accelerate once tools are released.

Risk score, explained

CVSS 5.3 reflects a denial-of-service attack (no confidentiality or integrity impact) requiring same-link network access with high attack complexity. The score appropriately captures that while the vulnerability is real and triggerable, it does not lead to data breach or privilege escalation—only service unavailability. In environments where dhcpcd restarts automatically (systemd, supervisor, container orchestrators), recovery is rapid, lowering practical risk. However, environments with manual restart dependencies or single-point-of-failure network configurations should treat this closer to high severity.

Frequently asked questions