CVE-2026-56116: dhcpcd IPv6 Router Advertisement Memory Leak DoS

Technical summary

The vulnerability exists in the routeinfo_findalloc() function within dhcpcd's IPv6 Router Advertisement handling. When processing Route Information options with a lifetime value of zero, the daemon fails to properly free previously allocated memory structures. By sending a stream of such crafted Router Advertisements, an attacker triggers cumulative memory allocations that are never deallocated, leading to linear memory consumption until the process exhausts available memory and terminates. The flaw affects versions through 10.3.2 and was corrected in commit 708b4a5.

Business impact

Affected systems lose IPv6 connectivity and DHCP services when dhcpcd crashes, disrupting both IPv4 and IPv6 network operations depending on the configuration. For environments relying on automated DHCP address assignment—particularly cloud infrastructure, enterprise networks, and IoT deployments—this denial-of-service condition can cascade into service unavailability. Repeated crashes may also trigger rate-limiting or lockout mechanisms if the daemon is monitored and auto-restarted.

Affected systems

dhcpcd versions through 10.3.2 running on systems that handle Router Advertisements and accept untrusted network traffic on the same link. This includes Linux distributions bundling dhcpcd as the primary DHCP client, embedded systems, and network appliances. Systems isolated from untrusted peers or running patched versions (incorporating commit 708b4a5 or later) are unaffected.

Exploitability

Exploitation requires the attacker to be on the same network link segment as the target, meaning they must share a direct layer-2 connection or be able to inject frames into the target's broadcast domain. No authentication is needed and the attack is trivial to execute: sending malformed Router Advertisements can be accomplished with standard IPv6 tools or simple scripting. The barrier to entry is low, though impact is limited to local networks. The CVSS score of 6.5 (MEDIUM) reflects the high availability impact but low scope (same-link only) and lack of confidentiality or integrity consequences.

Remediation

Apply patches incorporating the fix from commit 708b4a5 or later. Verify the exact patched version number against your vendor's advisory, as different Linux distributions may package the fix at different release versions. For systems unable to patch immediately, restrict network access to trusted peers only, implement link-layer filtering to reject Router Advertisements from unknown sources, or disable IPv6 if not required. Monitor dhcpcd process restarts and memory usage as a temporary detection mechanism.

Patch guidance

Contact your Linux distribution maintainer or dhcpcd project repository for the specific patched version incorporating commit 708b4a5. Ubuntu, Debian, Fedora, and other distributions will release updates through their standard package management systems. Verify patch availability by checking the vendor advisory and testing in a non-production environment before rolling out to production. Document the patched version and commit hash for audit purposes.

Detection guidance

Monitor system logs for repeated dhcpcd crashes or restarts, particularly those coinciding with IPv6 Router Advertisement activity. Use packet capture on the link to identify an unusually high volume of Router Advertisements with Route Information options and zero lifetimes from suspicious sources. Watch memory usage of the dhcpcd process for linear growth patterns that do not stabilize. A spike in RA packets followed by process termination is a strong indicator of exploitation.

Why prioritize this

This vulnerability is a same-link denial-of-service that requires network adjacency to exploit, placing it in the medium-risk category for most environments. However, organizations with shared or untrusted network segments—such as conference networks, cloud multi-tenant environments, or systems with numerous IoT/guest devices—should prioritize patching. The trivial exploitability and crash-to-recovery cycle make it a nuisance vector that warrants prompt but not emergency response for isolated corporate networks.

Risk score, explained

The CVSS 6.5 MEDIUM score (AV:A/AC:L/PR:N/UI:N/S:U) reflects: (1) Attack Vector Adjacent (A) — attacker must be on the same link; (2) Low Complexity (L) — no special conditions or timing; (3) No Privileges (N) — unauthenticated; (4) No User Interaction (N) — automatic exploitation; (5) Unchanged Scope (U) — impact limited to the affected component only. Availability impact is High (A:H) because the daemon crashes, but Confidentiality and Integrity are None. The CVSS does not account for detection or remediation ease, which should factor into local prioritization decisions.

Frequently asked questions