CVE-2026-124740: Busybox: use-after-free of requested_ipv6 in udhcpc6
A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by responding with a crafted Dynamic Host Configuration Protocol for IPv6 (DHCPv6) reply packet lacking usable address options. This issue causes the client to read stale heap memory, which can result in a Denial of Service (DoS) due to an application crash or disclose previously assigned network address data in subsequent discovery requests.
Other sources
A flaw was found in BusyBox's udhcpc6. The requestedipv6 pointer references a heap copy of the IANA option that is freed on every Reply before the new one is validated, and again in sendd6discover() just before the pointer is read. A malicious DHCPv6 server on the link can trigger this use-after-free with a Reply lacking a usable IANA or IAPD, causing a 16-byte stale heap read; the stale value, typically the previously assigned address, is then sent in the next Discover. Under hardened allocators this may cause the client to crash.
— Red Hat