RLSA-2026:97486: Low: dhcp security, bug fix, and enhancement update
The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network.
Security Fix(es):
dhcp-server: dhcp-server: Persistent denial of service due to buffer overflow via OMAPI (CVE-2026-18103)
Bug Fix(es) and Enhancement(s):
dhcpd dies constantly with "Error allocating fallback interface: invalid argument" (JIRA:Rocky Linux-151420)
Attempt to free pointer that is inside a structure in gethwaddr2 (JIRA:Rocky Linux-235872)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/dhcp-clientto a version that resolves this vulnerability.Fixed in 2:4.4.2-22.b1.el9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/dhcp-client-debuginfoto a version that resolves this vulnerability.Fixed in 2:4.4.2-22.b1.el9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/dhcp-debuginfoto a version that resolves this vulnerability.Fixed in 2:4.4.2-22.b1.el9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/dhcp-debugsourceto a version that resolves this vulnerability.Fixed in 2:4.4.2-22.b1.el9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/dhcp-relayto a version that resolves this vulnerability.Fixed in 2:4.4.2-22.b1.el9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/dhcp-relay-debuginfoto a version that resolves this vulnerability.Fixed in 2:4.4.2-22.b1.el9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/dhcp-serverto a version that resolves this vulnerability.Fixed in 2:4.4.2-22.b1.el9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/dhcp-server-debuginfoto a version that resolves this vulnerability.Fixed in 2:4.4.2-22.b1.el9.rocky.0.1 - Upgrade
Upgrade
rocky-linux/dhcp-commonto a version that resolves this vulnerability.Fixed in 2:4.4.2-22.b1.el9.rocky.0.1
Event History
Frequently Asked Questions
Which systems are exposed to the security issue?
The security fix identifies dhcp-server and an OMAPI-triggered condition. The advisory lists DHCP client and relay packages as updated, but does not attribute this vulnerability to them.
What access does an attacker need to exploit the issue?
The supplied CVSS vector indicates network reachability, low attack complexity, no user interaction, and high privileges required. The stated impact is persistent denial of service; confidentiality and integrity impacts are listed as none.
How can I determine whether a system needs the update?
Check whether the system has the dhcp-server package installed, especially where OMAPI is in use. The advisory does not provide affected or fixed package version numbers, so installed-version status cannot be determined from this data alone.