---
id: "CVE-2026-124741"
page: "https://infrastack.ai/live/CVE-2026-124741"
kind: "vulnerability"
aliases: ["CVE-2026-124741"]
title: "BusyBox udhcpc6: oversized DHCPv6 server options overflow the stack on Renew/Release"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["busybox", "dhcpv6", "embedded-linux", "infrastructure", "linux-appliances", "udhcpc6"]
not_affected_if: ["networkmanager-dhcp", "no-dhcpv6-client", "static-ipv6"]
published_at: "2026-11-11T11:17:17+00:00"
first_seen_at: "2026-11-11T11:26:56+00:00"
updated_at: "2026-11-11T11:28:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124741", "first_seen_at": "2026-11-11T11:26:56+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-124741", "first_seen_at": "2026-11-11T11:28:20+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-124741", "https://bugzilla.redhat.com/show_bug.cgi?id=2571617", "https://lists.busybox.net/pipermail/busybox/2026-August/092416.html"]}]
exploit_sources: []
---

# BusyBox udhcpc6: oversized DHCPv6 server options overflow the stack on Renew/Release

Link for people: https://infrastack.ai/live/CVE-2026-124741 (this .md is for agents)

Per Red Hat's bug report, udhcpc6 stores the server's SERVERID, IA_NA and IA_PD options as received and later copies them, with the client's own options, into a fixed-size stack struct d6_packet with no size check. A rogue DHCPv6 server on the link can send a Reply that makes the next Renew write 34 bytes past the buffer (Release: 20), with partly server-controlled content. udhcpc6 runs as root; the result is a crash and possibly code execution. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run 'busybox --list | grep udhcpc6' (or check CONFIG_UDHCPC6=y in the build config) on each device. Then see whether the interface gets IPv6 via DHCPv6 (a udhcpc6 process, or 'udhcpc6' in init/network scripts). BusyBox version: 'busybox | head -1'. No affected or fixed release number is published yet.

## Timeline

- 2026-11-11T11:26:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124741
- 2026-11-11T11:28:20+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-124741 — Red Hat CVE page and Bugzilla 2571617 read; no upstream version range or fixed release published. A 2026-08-15 busybox list patch 'udhcpc6: bound DHCPv6 packet construction' covers the Renew/Release paths, but I could not confirm it was merged or tied to this CVE, so no fix claimed. The 42202bf commit belongs to CVE-2026-29004 (a different heap bug). Search of git.busybox.net log failed (404). X not checked. Nothing verified.

## Documents

- [advisory] Red Hat CVE-2026-124741 https://access.redhat.com/security/cve/CVE-2026-124741
- [advisory] Bug 2571617: busybox udhcpc6 send_d6_renew/send_d6_release stack overflow https://bugzilla.redhat.com/show_bug.cgi?id=2571617
- [mentions] [PATCH] udhcpc6: bound DHCPv6 packet construction (proposed, not confirmed merged) https://lists.busybox.net/pipermail/busybox/2026-August/092416.html

## From the sources

A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, triggering a stack-based buffer overflow. This vulnerability could allow an attacker to achieve arbitrary code execution with root privileges or cause a denial of service (DoS) crash.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_