CVE-2026-124741 · Infrastructure
NO FIX YET
Per Red Hat's bug report, udhcpc6 stores the server's SERVERID, IA_NA and IA_PD options as received and later copies them, with the client's own options, into a fixed-size stack struct d6_packet with no size check. A rogue DHCPv6 server on the link can send a Reply that makes the next Renew write 34 bytes past the buffer (Release: 20), with partly server-controlled content. udhcpc6 runs as root; the result is a crash and possibly code execution. No exploitation or public PoC found.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Embedded and appliance systems (routers, containers, Alpine-style images) that ship BusyBox with udhcpc6 enabled and use it to get IPv6 settings are exposed to a rogue DHCPv6 server on the same network link. Red Hat says standard RHEL does not use BusyBox for DHCP (NetworkManager does), and lists RHEL 6 as unaffected and Red Hat Hardened Images as affected. Systems with static IPv6, or without udhcpc6, can skip it.
Not affected if networkmanager-dhcp, no-dhcpv6-client, static-ipv6
Who cares busybox, dhcpv6, embedded-linux, linux-appliances, udhcpc6
busybox --list | grep udhcpc6 (or check CONFIG_UDHCPC6=y in the build config) on each deviceudhcpc6 in init/network scripts)busybox | head -1Unknown from the sources.
A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, triggering a stack-based buffer overflow. This vulnerability could allow an attacker to achieve arbitrary code execution with root privileges or cause a denial of service (DoS) crash.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.