Severity by source
Adjacent network vector as DHCP is L2-scoped; no privileges or interaction needed; impact limited to lease-state integrity and availability disruption.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
2DescriptionCVE.org
[rx_dhcp_client 32-bit overflow in DHCP lease millisecond conversion]
AnalysisAI
Integer overflow in the rx_dhcp_client DHCP implementation allows a malicious or compromised DHCP server on the local network to trigger a 32-bit wraparound when converting DHCP lease durations from seconds to milliseconds. Affected systems processing a crafted DHCP lease response may experience incorrect lease expiry timing, premature lease renewal loops, or DHCP client process instability - potentially resulting in loss of network connectivity. No public exploit has been identified at time of analysis, and this CVE was reported via Ubuntu's vendor channel, suggesting discovery during internal auditing or upstream review.
Technical ContextAI
DHCP lease times are delivered by a server as 32-bit unsigned integer values in seconds (per RFC 2131). When a DHCP client implementation converts these values to milliseconds for timer scheduling, multiplying by 1000 can exceed the capacity of a 32-bit integer type (max ~4.29 billion ms, or ~4294967 seconds ≈ ~49.7 days). If the intermediate computation uses a 32-bit rather than 64-bit variable, lease values above this threshold cause a wraparound overflow. The rx_dhcp_client component appears to be a DHCP client library or subsystem, likely within the Linux networking stack or a userspace networking daemon, given the Ubuntu vendor report. No CWE is formally assigned in the provided data, but the root cause class is consistent with CWE-190 (Integer Overflow or Wraparound). No CPE strings were provided, limiting precise product scope identification.
Affected ProductsAI
The affected component is rx_dhcp_client, a DHCP client implementation reported by Ubuntu. Exact affected version ranges, package names, and CPE strings were not provided in the available intelligence. Based on the Ubuntu vendor report, affected distributions likely include Ubuntu Linux releases that ship the package containing rx_dhcp_client, but specific release versions (e.g., Ubuntu 22.04, 24.04 LTS) are not confirmed from the available data. Consumers should consult Ubuntu Security Notices (USN) and the Ubuntu CVE tracker at ubuntu.com/security/CVE-2026-52069 for authoritative version scope.
RemediationAI
The primary remediation is to apply the vendor-released patch once Ubuntu publishes a Security Notice (USN) for CVE-2026-52069. Monitor ubuntu.com/security/notices and subscribe to USN alerts for the affected package. As a compensating control, operators can restrict DHCP traffic at the network level using 802.1X port-based authentication or DHCP snooping on managed switches to ensure only authorized DHCP servers can respond to client requests - this eliminates the malicious-server prerequisite and effectively neutralizes the attack vector with minimal operational impact. On systems where DHCP lease times are operator-controlled, configuring lease durations below the 32-bit millisecond overflow threshold (~49.7 days) may prevent triggering the overflow, though this is a soft mitigation dependent on DHCP server configuration. No upstream fix version was independently confirmed from the provided data.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today