dhcpcd EUVD-2026-40941

The attacker must be on the same IPv6 link (Layer-2 broadcast domain or VLAN) as the target, as IPv6 Router Advertisements are link-local and not routable across network boundaries - this is the primary limiting factor. The target system must be running dhcpcd with IPv6 processing enabled; systems using alternative DHCP clients (dhclient, NetworkManager's internal DHCP, systemd-networkd) are not affected by this specific flaw. No authentication is required from the attacker (PR:N per CVSS vector), and no user interaction is needed on the target. No non-default configuration is required on the victim - any system running dhcpcd listening for IPv6 RAs on a network-connected interface is vulnerable. Exploitation is limited to denial of service; no code execution or data exfiltration is possible.

The CVSS 3.1 base score of 6.5 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the threat model: exploitation is constrained to adjacent-network attackers (AV:A), meaning the adversary must share a Layer-2 broadcast domain or VLAN with the target - they cannot exploit this from the open internet. Within that constraint, no privileges or user interaction are required, and attack complexity is low, making exploitation trivial for any on-path or on-link attacker. The impact is purely availability (CPU exhaustion DoS); there is no confidentiality or integrity exposure. No EPSS score was provided in the input, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed mass exploitation. No public proof-of-concept code was identified in the available references. Real-world risk is moderate-to-significant in multi-tenant or shared network environments (cloud provider subnets, enterprise Wi-Fi, colocation facilities) where untrusted parties share a network segment, but negligible in tightly controlled point-to-point or private LAN deployments. The availability impact is rated High because a sustained loop fully consumes CPU, effectively taking the host offline for network-dependent functions.

An attacker positioned on the same Layer-2 network segment as a target host running dhcpcd - for example, a malicious guest on a shared cloud VLAN or a rogue device on an enterprise Wi-Fi network - crafts and broadcasts an IPv6 Router Advertisement containing a Neighbor Discovery option with a length field set to zero. No public proof-of-concept code has been identified, but constructing such a packet requires only standard raw socket privileges and publicly documented RA packet structure. Upon receipt, dhcpcd stores the malformed option and later re-parses it without validating that the length field advances the parser, causing it to loop indefinitely and consume all available CPU cycles, making the affected host unresponsive.