Double Free in µD3TN BPv6 Fragmenter Block Duplication Causes DoS

Executive Summary

CVE-2026-121507 is a double free vulnerability in the µD3TN BPv6 fragmenter. It occurs when the bundle_block_dup function performs a shallow copy of a bundle block, including its data pointer. If memory allocation for an EID reference list fails during fragmentation, the error handling frees the duplicate block's data buffer, which is actually the original block's data. Later, when the original bundle is discarded, its data buffer is freed again, causing a double free. This leads to heap corruption or process termination.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or heap corruption in µD3TN instances handling BPv6 fragmented bundles. Check logs for segmentation faults or double free errors. Monitor memory usage patterns during bundle fragmentation operations. Use debugging tools like AddressSanitizer or Valgrind to detect double free issues during bundle processing.

Useful 0 Not Useful 0

Impact Analysis

An unauthenticated remote attacker could exploit this to cause a denial of service by crashing the µD3TN node. The double free may corrupt memory or terminate the process, disrupting bundle processing and network operations.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the official patch from µD3TN addressing the `bundle_block_dup` function. Update to the latest version where the aliased data pointer is cleared after shallow copy. If immediate patching is not possible, disable bundle fragmentation functionality or restrict network access to trusted sources until patched.

Useful 0 Not Useful 0