CVE-2026-56113

Name of the Vulnerable Software and Affected Versions dhcpcd versions prior to 10.3.3

Description A heap use-after-free issue exists where unauthenticated attackers on the same link can crash the daemon. This occurs when a crafted DHCPv6 RENEW reply is sent containing an RFC6603 OPTION PD EXCLUDE with both preferred and valid lifetimes set to zero. An attacker impersonating a DHCPv6 server can trigger the dhcp6 deprecatedele() function to free a delegated child address. Because an outer TAILQ FOREACH SAFE iterator in the dhcp6 deprecateaddrs() function still holds the freed pointer, a use-after-free occurs when TAILQ REMOVE is reached.

Recommendations Update to the version containing commit 5733d3c.