UBUNTU-CVE-2026-124740: Use After Free
A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by responding with a crafted Dynamic Host Configuration Protocol for IPv6 (DHCPv6) reply packet lacking usable address options. This issue causes the client to read stale heap memory, which can result in a Denial of Service (DoS) due to an application crash or disclose previously assigned network address data in subsequent discovery requests.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems running BusyBox's udhcpc6 DHCPv6 client are exposed when they obtain IPv6 configuration from a DHCPv6 server on their local network. The attack requires a malicious or attacker-controlled DHCPv6 server to be reachable on that network.
What does an attacker need to exploit the flaw?
An unauthenticated attacker needs to send the udhcpc6 client a crafted DHCPv6 reply packet that lacks usable address options. No user interaction is required.
What are the observable consequences of exploitation?
The client may crash, causing a denial of service. It may also read stale heap memory and include previously assigned network address data in later discovery requests.