CVE-2026-53922

6.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Adjacent network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-121, CWE-191

Impact

Adjacent unauthenticated attackers can crash odhcpd and cause a persistent denial of service for DHCPv6 service. They only need local network access to send crafted DHCPv6 RENEW requests.

Root cause

An integer underflow on an unsigned size_t buffer length calculation triggers a stack buffer overflow, causing a stack canary crash in handle_client_request().

Affected systems

odhcpd commit cfddd56 and earlier; OpenWrt prior to v25.12.5.

CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade OpenWrt to v25.12.5 or pull the latest odhcpd package commits (c6792bac, d08dbcc5, d168c27f, d329a154). If patching immediately is not possible, disable DHCPv6 services in the odhcpd configuration or restrict untrusted adjacent traffic.

shell

$ opkg update && opkg upgrade odhcpd

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the build_ia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6_ia_handle_IAs() subtracts that over-return from an unsigned size_t. The resulting underflow disables subsequent length checks and permits attacker-controlled IA_ADDR serialization beyond the 512-byte stack buffer pdbuf in handle_client_request(). The stack canary terminates odhcpd, and sustained packets can repeatedly disrupt DHCPv6 service while procd respawns the process. The observed configuration does not establish code execution.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-53922