Executive Summary

CVE-2026-56116 is a memory leak vulnerability in dhcpcd versions up to 10.3.2 related to the handling of IPv6 Router Advertisement route information.

An unauthenticated attacker on the same local network can exploit this by sending specially crafted Router Advertisements containing Route Information options with a lifetime of zero.

This causes the function routeinfo_findalloc() to allocate memory that is never freed, leading to linear memory exhaustion and eventually crashing the dhcpcd daemon.

The attack requires no privileges or user interaction.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service (DoS) on systems running vulnerable versions of dhcpcd by crashing the dhcpcd daemon.

An attacker on the same local network can repeatedly send crafted Router Advertisements to exhaust memory, leading to service disruption.

Since dhcpcd is responsible for network configuration, its crash can disrupt network connectivity and related services.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusual or repeated IPv6 Router Advertisements containing Route Information options with a lifetime of zero, which trigger the memory leak in dhcpcd.

On the system running dhcpcd, signs of the vulnerability include increasing memory usage by the dhcpcd daemon and potential crashes of the daemon.

Suggested commands to detect exploitation attempts or symptoms include:

• Use tcpdump or tshark to capture and filter IPv6 Router Advertisements with Route Information options:
• tcpdump -i <interface> 'icmp6 and ip6[40] == 134'
• Analyze captured packets for Route Information options with a lifetime of zero.
• Monitor dhcpcd process memory usage with commands like: ps aux | grep dhcpcd or top/htop.
• Check system logs for dhcpcd crashes or restarts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating dhcpcd to a version that includes the fix from commit 708b4a5 or later.

If updating is not immediately possible, consider restricting or filtering IPv6 Router Advertisements on the local network to prevent attackers from sending crafted packets with Route Information options having a lifetime of zero.

Additionally, monitor the dhcpcd daemon for abnormal memory usage or crashes and restart it as necessary to maintain service availability.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-56116 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0