CVE-2026-56113: dhcpcd Heap Use-After-Free in dhcp6_deprecateaddrs via DHCPv6 RENEW
dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTIONPDEXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6deprecatedele() to free a delegated child address while an outer TAILQFOREACHSAFE iterator in dhcp6deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQREMOVE is reached.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dhcpcdto a version that resolves this vulnerability.Patch commit 5733d3c - Compensating control
Mitigate unauthenticated same-link attacks by restricting network access so attackers cannot send crafted DHCPv6 RENEW replies (same-link/adjacent) to dhcpcd—e.g., limit/deny DHCPv6 message ingress at the network boundary for untrusted sources.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56113?
The severity of CVE-2026-56113 is rated as medium with a score of 6.
How do I fix CVE-2026-56113?
To fix CVE-2026-56113, update your dhcpcd software to the version including commit 5733d3c.
What type of vulnerability is identified in CVE-2026-56113?
CVE-2026-56113 is a heap use-after-free vulnerability.
Who can exploit CVE-2026-56113?
CVE-2026-56113 can be exploited by unauthenticated attackers on the same link.
What impact does CVE-2026-56113 have on the system?
CVE-2026-56113 can cause the dhcpcd daemon to crash.