CVE-2026-93006: Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content
A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.
Other sources
A use-after-free cache-key confusion was found in dnsmasq's TFTP prefetch path in getblock() (src/tftp.c). The prefetch cache uses daemon->srvsave (a void pointer to the tftptransfer struct) and a static savedoffset as cache keys. When a transfer completes, freetransfer() frees the transfer struct without clearing daemon->srvsave, leaving a dangling pointer as a valid cache key.
If a later TFTP transfer is allocated at the same heap address (common after free+malloc of the same size) and the new transfer's offset matches savedoffset, getblock() returns previously cached file content from daemon->packet without reading the new client's file from disk. In a PXE environment this can substitute attacker-controlled file content for a victim's boot file.
The cache check compares only pointer identity and offset. It does not verify filename, inode, file descriptor, or client identity. daemon->srvsave is shared with DNS forwarding, so DNS activity overwrites the TFTP cache key and accidentally mitigates the bug in mixed DNS/TFTP deployments.
Compile-time gate: HAVETFTP is defined by default (src/config.h). Runtime gate: --enable-tftp. Exploitation is deterministic when DNS is inactive and clients do not negotiate TFTP options (the OACK path clears srvsave).
Affected versions: v2.92 through HEAD. Introducing commit: ee09f06 (Optimise tftp). Unaffected: v2.91 and earlier (no savedoffset prefetch cache). Fix: Not yet available (reporter coordinating with upstream). Reporter: Shubham Raj (Causal Security) PSIRT Ticket: PSIRTSUPT-23743
— Red Hat
Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content
— Microsoft