Executive brief
dhcpcd is a widely used tool that allows computers to automatically obtain network addresses. A flaw in how it handles certain network updates allows an attacker on the same local network to crash the service. This can lead to a loss of network connectivity for the affected system, potentially disrupting operations or management access.
Technical details
A heap use-after-free vulnerability exists in dhcpcd versions up to 10.3.2 within the DHCPv6 address deprecation logic. The issue occurs when an unauthenticated attacker on the same network link acts as or impersonates a DHCPv6 server and sends a crafted RENEW reply containing an RFC6603 OPTION_PD_EXCLUDE with preferred and valid lifetimes set to zero. This triggers dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds a pointer to that memory. When the iterator reaches TAILQ_REMOVE, it attempts to access the already freed pointer, resulting in a daemon crash (DoS). The vulnerability is fixed in commit 5733d3c.
Affected products
- NetworkConfiguration dhcpcd through 10.3.2
Timeline
- 2026-06-23: disclosed
- 2026-06-23: advisory