Executive brief
wicked is a network configuration daemon used in Linux systems to manage network interfaces and DHCP. An integer underflow vulnerability in the DHCPv4 packet capture code can allow an attacker on the same network to send malformed packets that cause the DHCP client daemon to crash, resulting in network configuration service disruption. No data exposure has been demonstrated, but the service disruption could prevent systems from obtaining or maintaining network connectivity.
Technical details
The vulnerability is an integer underflow in the ni_capture_inspect_udp_header() function in src/capture.c of wicked. The function fails to validate that the IP total length field (ip_len) is at least as large as the IP header length (ihl) before performing subtraction, leading to integer underflow of a size_t variable that is later truncated to uint16_t for UDP checksum validation. An unauthenticated attacker on the adjacent network can craft malformed DHCPv4 packets with invalid IP header lengths to trigger out-of-bounds reads past the receive buffer in the wickedd-dhcp4 daemon. Depending on memory layout and content, this can cause the daemon to crash, resulting in denial of service. The vulnerability affects wicked versions up to and including 0.6.80, and fixes are available in the project repository as of August 2026.
Affected products
- openSUSE wicked up to and including 0.6.80
Timeline
- 2026-08-27: disclosed: CVE-2026-71401 published
- 2026-08-27: patched: Fix merged in GitHub PR #1079