CVE-2026-110912

Deferred Deferred - Pending Action

ARP Packet Handling Memory Disclosure in DragonFly BSD

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: MITRE

Description

In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() then uses these attacker-controlled values as memcpy lengths when copying from kernel buffers that are only 6 and 4 bytes long, resulting in an out-of-bounds read of kernel heap and stack memory that is copied into the ARP reply sent back to the requester. An unauthenticated attacker on the adjacent network can use a single crafted ARP request to disclose up to roughly 250 bytes of each type of kernel memory, including kernel pointers. This is expected to be fixed in the 6.6 stable release when that is available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110912

EUVD

EUVD-2026-101819

Affected Vendors & Products

Vendor	Product	Version / Range
DragonFlyBSD	DragonFlyBSD	984263bcb83ad82313113c6ac840d99124d8f90c

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-130	The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

Attack-Flow Graph

Executive Summary

CVE-2026-110912 is a kernel memory leak vulnerability in DragonFly BSD through version 6.4.2. It occurs because the ARP input handlers do not validate the hardware address length and protocol address length fields in incoming ARP packets. This allows an attacker to craft a malicious ARP request that causes the system to read beyond the intended memory buffers when building a reply, leaking sensitive kernel memory including pointers.

Detection Guidance

Monitor network traffic for malformed ARP packets with unusual hardware or protocol address lengths. Use tcpdump to capture ARP traffic and inspect ar_hln and ar_pln fields. Example: tcpdump -i any -nn -e arp. Check kernel logs for memory corruption errors or unexpected kernel memory disclosures.

Impact Analysis

An unauthenticated attacker on the same network can exploit this to disclose up to roughly 250 bytes of kernel memory per crafted ARP request. This could expose sensitive information such as kernel pointers, which may aid in further attacks like privilege escalation or bypassing security mechanisms.

Compliance Impact

This vulnerability allows unauthenticated attackers on the same network to disclose up to roughly 250 bytes of kernel memory, including kernel pointers. Such memory leaks could expose sensitive data or system internals, potentially violating confidentiality requirements in GDPR or HIPAA. However, the direct impact depends on the specific data exposed and the organization's security controls.

Mitigation Strategies

Upgrade DragonFlyBSD to a version containing the fix (commit 4bb22ff). If immediate upgrade is not possible, restrict ARP traffic at the network perimeter or disable ARP processing on untrusted interfaces. Monitor for suspicious ARP requests.

Hi! I’m here to help you understand CVE-2026-110912. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70