EUVD-2026-40941
GHSA-hm5v-wwxq-27x8
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AV:A because RA packets are link-local only; PR:N and AC:L as any adjacent host can send a crafted RA; A:H for CPU-exhaustion DoS with no C or I impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.
AnalysisAI
Denial of service in dhcpcd's IPv6 Neighbor Discovery Router Advertisement parser allows an adjacent unauthenticated attacker to exhaust CPU resources on any host running dhcpcd with IPv6 enabled. The flaw (CWE-835 - infinite loop) arises because a zero-length Neighbor Discovery option passes initial storage validation but is later reparsed without sufficient bounds enforcement, causing the parser to loop indefinitely without advancing. No active exploitation is confirmed (not in CISA KEV), but the adjacent-network attack vector and zero-privilege requirement make this actionable on shared Layer-2 environments such as enterprise Wi-Fi, cloud VLANs, and data-center segments.
Technical ContextAI
dhcpcd is a portable, feature-rich DHCP/DHCPv6 client daemon also responsible for IPv6 stateless address autoconfiguration (SLAAC) via the Neighbor Discovery Protocol (NDP). Router Advertisements (RAs) are IPv6 control-plane messages sent by routers to advertise network prefixes and configuration options; they are received by all hosts on a link without authentication. The RA packet format allows for variable-length Neighbor Discovery options, each beginning with a type and length field. CWE-835 (Loop with Unreachable Exit Condition) describes the root cause: when an option length of zero is stored and later used to drive a parsing loop, the loop's forward-progress condition is never satisfied, creating a non-terminating iteration. The affected product per CPE is cpe:2.3:a:red_hat:red_hat_enterprise_linux_10, indicating Red Hat packages dhcpcd in RHEL 10; the underlying vulnerable component is the upstream dhcpcd project maintained at github.com/NetworkConfiguration/dhcpcd.
RemediationAI
The primary fix is an upstream commit to the dhcpcd source tree at https://github.com/NetworkConfiguration/dhcpcd/commit/75289ca, which addresses the zero-length option parsing loop. A specific tagged release version incorporating this commit has not been confirmed from the available data; users should verify whether their distribution has issued a patched package. For RHEL 10, monitor https://access.redhat.com/security/cve/CVE-2026-14258 for an updated RPM. As a compensating control where patching is not immediately possible, network-level filtering can block unsolicited ICMPv6 Router Advertisement messages (ICMPv6 type 134) at the host firewall using ip6tables or nftables - note this will also block legitimate RA-based SLAAC, requiring static IPv6 addressing or DHCPv6 as alternatives. On managed switches, enabling RA Guard (RFC 6105) on access ports prevents rogue RA injection from non-router ports without disrupting legitimate routing. Disabling IPv6 entirely on interfaces where it is not required is a more disruptive but complete mitigation. Restricting dhcpcd to only process RAs from known, trusted router MAC addresses via configuration can reduce exposure on networks where the upstream router is known.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Micro 6.2 | Affected |
| openSUSE Leap 16.0 | Affected |
| SLES-CHOST-BYOS-Aliyun | Affected |
| SLES-CHOST-BYOS-Azure | Affected |
| SLES-CHOST-BYOS-EC2 | Affected |
| SLES-CHOST-BYOS-GCE | Affected |
| SLES-CHOST-BYOS-GDC | Affected |
| SLES-CHOST-BYOS-SAP-CCloud | Affected |
Share
External POC / Exploit Code
Leaving vuln.today