CVE-2026-56117: dhcpcd Heap Use-After-Free in Control Socket (MEDIUM 4.7)

Technical summary

The vulnerability exists in src/control.c's socket handling logic. When dhcpcd processes a privileged command (such as -x) via the control socket, the control_recvdata() function frees a client object. However, a subsequent READ+HANGUP event on the same socket reaches control_hangup() with a stale pointer to the now-freed memory, creating a use-after-free condition (CWE-416). This occurs specifically when privilege separation (privsep) is disabled via the --disable-privsep flag or when privsep initialization fails, leaving the control socket with world-readable permissions (mode 0666). The flaw was fixed in commit 78ea09e.

Business impact

In affected deployments, an unprivileged local user can repeatedly crash dhcpcd, disrupting network configuration and renewal. This is most critical in headless or embedded systems that depend on dhcpcd for persistent network connectivity and lack alternative DHCP mechanisms. Organizations using dhcpcd in containers, VMs, or minimal Linux distributions with privsep disabled should treat this as a service availability concern, though exploitation requires prior local system access.

Affected systems

dhcpcd versions through 10.3.2 are vulnerable when configured with --disable-privsep or when privsep initialization fails. The risk is highest on systems where untrusted local users exist or where the system hosts multi-tenant workloads. Standard desktop and server deployments with privilege separation enabled are not affected. Embedded systems, lightweight distributions, and custom builds that explicitly disable privsep or run dhcpcd in restricted containers face the greatest exposure.

Exploitability

Exploitation requires local system access and the ability to connect to dhcpcd's control socket. The technical bar is low—a local user simply sends a privileged command to trigger the memory corruption. No authentication is required if the control socket is world-readable (mode 0666), which occurs when privsep is disabled. The vulnerability is not remotely exploitable. CVSS score 4.7 (Medium) reflects local access requirement and high impact (denial of service) balanced against the specific configuration prerequisite.

Remediation

Update dhcpcd to a patched version incorporating commit 78ea09e or later. Verify against the vendor's advisory for the specific release number. As an interim mitigation, ensure privilege separation is enabled (the default) and verify the control socket permissions are restrictive. Review system configurations to eliminate unnecessary --disable-privsep flags. Monitor for any systems running dhcpcd in environments where local user access cannot be fully controlled.

Patch guidance

Apply the dhcpcd update that includes the fix from commit 78ea09e. Verify the patched version with your package manager or vendor release notes. After patching, confirm that privilege separation is enabled and the control socket has appropriate file permissions (not world-readable). Test DHCP renewal and dynamic reconfiguration to ensure the patch does not introduce regressions in your environment.

Detection guidance

Monitor system logs for unexpected dhcpcd crashes or restarts, particularly on systems with untrusted local users. Watch for repeated connection attempts to the dhcpcd control socket (typically /var/run/dhcpcd/control or similar, depending on configuration). File integrity monitoring on the dhcpcd binary and configuration files can alert to unauthorized changes. Check running processes to confirm privilege separation status: if privsep is disabled, the risk surface is active.

Why prioritize this

Although the CVSS score is Medium (4.7), prioritization depends on your deployment model. Prioritize patching if you run dhcpcd with --disable-privsep in production, host untrusted local users, or rely on dhcpcd for critical network services. Standard privileged-separation-enabled deployments can address this in a regular patch cycle. The lack of KEV designation and remote exploitability indicates this is not an imminent widespread threat, but denial-of-service impact in specific configurations warrants prompt attention.

Risk score, explained

CVSS 4.7 (Medium) is assigned under CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H. The score reflects: local attack vector (AV:L), high attack complexity due to the --disable-privsep configuration requirement (AC:H), low privilege requirement (PR:L; any local user can trigger it), no user interaction needed (UI:N), impact limited to availability/denial of service (A:H, no confidentiality or integrity impact), and no scope change (S:U). The Medium rating is appropriate for a local DoS with a configuration prerequisite.

Frequently asked questions