Medium [CVE-2026-14258] Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling
This medium-severity Red Hat Linux advisory covers CVE-2026-14258 affecting Red Hat Enterprise Linux 10, Red Hat package: dhcpcd.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.
Red Hat Product Security has rated this vulnerability as Moderate. Because Router Advertisements are processed automatically by dhcpcd, no additional user interaction or prior authentication is required.
The root cause of this vulnerability is inconsistent validation during Router Advertisement processing. While malformed Neighbor Discovery options are detected during the initial parsing stage, a specially crafted packet may already have been retained for subsequent processing.
``` Earlier upstream release 75289ca (dhcpcd v10.2.0) addressed this by immediately discarding malformed Router Advertisements before they could be reparsed.
Subsequent upstream changes (805fe4ac) further strengthened the implementation by validating all Neighbor Discovery options before storing the packet, improving the overall robustness of the parsing logic. Only Red Hat Enterprise Linux 10 and Red Hat In Vehicle OS ships "dhcpcd".
Both products are shipped with affected versions. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-835. Affected Red Hat products: Red Hat Enterprise Linux 10.
Red Hat fixing advisory: RHSA-2026:54210.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
- dhcpcd-0:10.0.6-11.el10_2
- RHSA-2026:54210
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- Until an updated package is available, administrators should disable IPv6 Router Advertisement processing on interfaces where it is not required or restrict acceptance of untrusted ICMPv6 Router Advertisements using appropriate network filtering. Systems that rely on IPv6 Stateless Address Autoconfiguration (SLAAC) or Router Advertisement-based network configuration should carefully evaluate the operational impact before applying these mitigations.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.