Compliance Impact

The provided information does not include any details on how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-56113 is a heap use-after-free vulnerability in dhcpcd versions up to 10.3.2. It occurs when the dhcp6_deprecatedele() function frees a delegated child address while an outer iterator in dhcp6_deprecateaddrs() still holds a pointer to that freed memory. This happens when a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero is sent. The use-after-free leads to a crash of the dhcpcd daemon.

The root cause is improper handling of IPv6 address deprecation during prefix deletion, where deleting an address invalidates the iteration pointer used to traverse the list of addresses, causing invalid memory access.

The fix involves modifying the dhcp6_deprecatedele function to signal when the iteration should restart and adding logic to restart the loop to ensure all addresses are processed safely.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated attacker on the same network segment to impersonate a DHCPv6 server and send a specially crafted DHCPv6 RENEW reply that triggers a use-after-free condition, causing the dhcpcd daemon to crash.

The impact is a denial of service (DoS) condition on the affected system, potentially disrupting network connectivity or services relying on dhcpcd.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if the dhcpcd daemon version is 10.3.2 or earlier, as these versions are affected.

Monitoring for crashes or abnormal behavior of the dhcpcd daemon when receiving DHCPv6 RENEW replies with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero can indicate exploitation attempts.

You can check the dhcpcd version installed on your system using the command:

• dhcpcd --version

To monitor network traffic for suspicious DHCPv6 RENEW messages with the specific crafted options, you can use packet capture tools such as tcpdump:

• sudo tcpdump -i <interface> 'udp and port 546 or 547'

Then analyze captured packets for DHCPv6 RENEW messages containing OPTION_PD_EXCLUDE with preferred and valid lifetimes set to zero.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to update dhcpcd to a version that includes the fix from commit 5733d3c or later.

If updating immediately is not possible, consider restricting or filtering DHCPv6 RENEW messages on your network to prevent unauthenticated or malicious DHCPv6 servers from sending crafted packets that exploit this vulnerability.

Monitoring and logging dhcpcd daemon crashes can help detect exploitation attempts and respond accordingly.

Useful 0 Not Useful 0