Executive brief
A vulnerability exists in dhcpcd, a common tool used by Linux and BSD systems to configure network interfaces. When processing specific configuration options, the software may crash due to a programming error. This could lead to a denial-of-service, preventing the system from correctly connecting to or maintaining its network configuration.
Technical details
A NULL pointer dereference vulnerability was identified in dhcpcd version 10.3.0 within the parse_option() function located in src/if-options.c. The issue arises when an unexpected or invalid option token causes a lookup to return NULL, which is subsequently accessed as a 'struct dhcp_opt' member without proper validation. This flaw was discovered via instrumented fuzzing. An attacker with the ability to modify or provide a malformed configuration file could trigger this crash, resulting in a denial-of-service (DoS) of the DHCP client daemon.
Affected products
- Roy Marples NetworkConfiguration dhcpcd 10.3.0
Timeline
- 2026-06-15: disclosed: CVE published to the NVD dataset.