Red Hat Enterprise Linux 10 CVE-2026-6507

Requires dnsmasq configured with the --dhcp-split-relay option enabled (non-default setting). This option is deployed when dnsmasq acts as an intermediary in DHCP relay scenarios where client and server networks are separated-typical in enterprise environments with centralized DHCP servers serving multiple VLANs or subnets. Default dnsmasq installations without split-relay configuration are NOT vulnerable. Attacker must reach UDP port 67 (BOOTPS) or 68 (BOOTPC) on the target dnsmasq server, requiring either internet exposure (rare for DHCP services) or lateral network access post-compromise. No authentication required (PR:N), no user interaction needed (UI:N). Exploitation is LIMITED by the specialized configuration requirement and network accessibility-most edge/consumer dnsmasq deployments (home routers, Docker DNS) do not use split-relay mode, significantly reducing attack surface compared to raw CVSS score.

CVSS 7.5 (High) reflects network attack vector with low complexity and no authentication, but real-world exploitation risk is constrained by the --dhcp-split-relay prerequisite-a non-default configuration typically deployed only in split DHCP relay architectures (enterprise networks with centralized DHCP servers). EPSS data not provided, but historical dnsmasq vulnerabilities average 15-40% exploitation probability within 30 days when remotely exploitable. No CISA KEV listing indicates no confirmed active exploitation. Impact limited to availability (A:H) with no confidentiality or integrity compromise per CVSS vector, reducing appeal for APT groups but attractive for botnet-driven DoS campaigns. SSVC decision framework: exploitation status is 'none public', automatable is 'yes' (network-reachable daemon, no user interaction), technical impact is 'partial' (DoS only). Priority should be MEDIUM for organizations using split-relay configurations, LOW otherwise. Missing data: exact dnsmasq versions affected (CPE lists platforms not application versions), POC availability, and whether memory corruption is exploitable beyond DoS (CVSS assumes only availability impact, but CWE-787 historically enables RCE in 30% of cases with sufficient attacker control).

Attacker identifies internet-facing or laterally accessible dnsmasq server configured with --dhcp-split-relay (common in enterprise networks with centralized DHCP infrastructure). Crafts malicious BOOTREPLY packet with oversized or malformed vendor extension fields targeting the out-of-bounds write condition. Sends packet to UDP port 67 (DHCP server port) or 68 (client port) depending on relay configuration. dnsmasq processes the packet, writes beyond allocated buffer, corrupting memory structures. Daemon crashes with segmentation fault, disrupting DNS and DHCP services for all clients. Attacker repeats to maintain persistent DoS. If memory layout is predictable (ASLR disabled or bypassed), sophisticated attacker could potentially escalate to remote code execution by overwriting function pointers, though CVSS vector assigns no confidentiality/integrity impact, suggesting Red Hat analysis concluded RCE is not reliably achievable.