CVE-2026-56113

Publication date 23 June 2026

Last updated 26 June 2026

Ubuntu priority

Cvss 3 Severity Score

Description

dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers to crash the daemon by sending a crafted DHCPv6 RENEW reply with RFC6603 OPTION_PD_EXCLUDE and both preferred and valid lifetimes set to zero. Attackers acting as or impersonating a DHCPv6 server can trigger dhcp6_deprecatedele() to free a delegated child address while an outer TAILQ_FOREACH_SAFE iterator in dhcp6_deprecateaddrs() still holds the freed pointer, causing a use-after-free when TAILQ_REMOVE is reached.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
dhcpcd	26.04 LTS resolute	Needs evaluation
	25.10 questing	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Not in release

Severity score breakdown

CVSS version:

Base score 6.0 · Medium

Base metrics

Parameter	Value
Attack vector	Adjacent
Attack complexity	Low
Attack requirements	Present
Privileges required	None
User interaction	None
Vulnerable system - Confidentiality impact	None
Vulnerable system - Integrity impact	None
Vulnerable system - Availability impact	High
Subsequent system - Confidentiality impact	None
Subsequent system - Integrity impact	None
Subsequent system - Availability impact	None

Scores

Parameter	Value
Base score	6.0 · Medium
Base + Threat score	-
Base + Environmental score	-
Base + Threat + Environmental score	-

Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Base score 5.3 · Medium