CVE-2026-53922: odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IANA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the buildia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6iahandleIAs() subtracts that over-return from an unsigned sizet. The resulting underflow disables subsequent length checks and permits attacker-controlled IAADDR serialization beyond the 512-byte stack buffer pdbuf in handleclientrequest(). The stack canary terminates odhcpd, and sustained packets can repeatedly disrupt DHCPv6 service while procd respawns the process. The observed configuration does not establish code execution.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this denial of service?
OpenWrt devices running odhcpd at commit cfddd56 or earlier are affected when an unauthenticated attacker can reach the device on the same DHCPv6 link. The attack targets the DHCPv6 service rather than requiring access to the device management interface.
What does an attacker need to do to trigger the issue?
The attacker needs same-link network access and no credentials. They first obtain two DHCPv6 bindings through normal SOLICIT and REQUEST exchanges, then send a crafted RENEW containing multiple IA_NA options arranged to trigger the size_t underflow.
What is the practical impact of exploitation?
The stack canary terminates odhcpd after the stack buffer overflow, disrupting DHCPv6 service. Repeated packets can keep causing outages as procd respawns the process; the observed configuration does not establish code execution.
How can I determine whether an instance is vulnerable?
Check whether the deployed odhcpd source includes commit cfddd56 or an earlier revision. The provided fixes are commits c6792bac3905d4bf726d914e9994f6d4b98c5b57 and d08dbcc527cb8f296cd132c1e5bca696e77095b8.