CVE-2026-6554: infinte loop in libpcap before 1.10.7
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libpcapto a version that resolves this vulnerability.Fixed in 1.10.7
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems that use a vulnerable libpcap BPF interpreter and execute crafted filter programs are exposed. Exploitation requires local access and low privileges, as reflected by the AV:L and PR:L vector.
What does an attacker need to exploit it?
An attacker needs the ability to supply or cause execution of a crafted BPF filter program containing a backward 'ja L' jump. No user interaction is required.
What is the impact of successful exploitation?
The crafted filter can make the BPF interpreter loop indefinitely, causing a denial of service. The provided vector indicates no confidentiality or integrity impact.
What should be done if patching is not immediately possible?
Restrict low-privileged users from supplying or modifying BPF filter programs, and avoid executing untrusted filter programs. This reduces the opportunity to trigger the uncontrolled loop.