Medium [CVE-2026-56116] Denial of Service via IPv6 Router Advertisement memory leak
This medium-severity Red Hat Linux advisory covers CVE-2026-56116 affecting Red Hat Enterprise Linux 10, Red Hat package: dhcpcd.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements.
Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash. A flaw was found in dhcpcd.
By repeatedly sending specially crafted Router Advertisements with a zero lifetime, the attacker can cause the system to exhaust its memory, leading to a denial of service and a daemon crash. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-772. Affected Red Hat products: Red Hat Enterprise Linux 10.
Red Hat does not currently list a fixing RHSA for this CVE.
Affected products named by the advisory: Red Hat package: dhcpcd.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
Mitigation checklist
- To mitigate this issue, consider disabling IPv6 on systems where it is not required. This can be achieved temporarily by running `sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1` and `sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1`. For permanent disablement, add `net.ipv6.conf.all.disable_ipv6 = 1` and `net.ipv6.conf.default.disable_ipv6 = 1` to a file like `/etc/sysctl.d/99-disable-ipv6.conf` and apply with `sudo sysctl -p`. Disabling IPv6 may impact network functionality that relies on it. A system restart or network service reload may be required for changes to take effect.
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.