CVE-2026-53922

Name of the Vulnerable Software and Affected Versions odhcpd versions prior to commit cfddd56

Description An unauthenticated host on the same link can disrupt the DHCPv6 service by sending a crafted RENEW request containing multiple IA NA options after obtaining two bindings. This process triggers an underflow in the dhcpv6 ia handle IAs() function when it subtracts an over-return value from an unsigned size t variable. This underflow bypasses length checks, allowing attacker-controlled IA ADDR serialization to exceed the 512-byte stack buffer pdbuf within the handle client request() function. This results in the termination of the odhcpd process by the stack canary, leading to a denial of service as the process is repeatedly respawned by procd.

Recommendations Update odhcpd to a version incorporating commit cfddd56 or later.