Bug 2458519 (CVE-2026-4893)

Summary:	CVE-2026-4893 dnsmasq: Broken ECS source validation bypass
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A validation bypass was discovered in dnsmasq's RFC 7871 client subnet (ECS) handling. When verifying ECS source information in DNS responses, dnsmasq passes the OPT record length instead of the full packet length to the validation function.This causes all internal bounds checks to fail, completely bypassing ECS source validation and allowing an attacker to spoof client subnet information.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-05-09

Description OSIDB Bzimport 2026-04-14 22:55:42 UTC

In forward.c:724, process_reply() calls check_source(header, plen, pheader, query_source) but plen at this point holds the OPT record length (~23 bytes), not the packet length n. With the wrong length, all bounds checks inside check_source() fail and the function unconditionally returns 1, bypassing RFC 7871 Section 9.2 ECS source validation entirely. Fix: change plen to n in the function call.

Comment 2 errata-xmlrpc 2026-05-19 16:10:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19158 https://access.redhat.com/errata/RHSA-2026:19158

Comment 3 errata-xmlrpc 2026-05-19 21:41:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19373 https://access.redhat.com/errata/RHSA-2026:19373

Comment 4 errata-xmlrpc 2026-05-26 04:57:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:20589 https://access.redhat.com/errata/RHSA-2026:20589

Comment 5 errata-xmlrpc 2026-07-01 21:09:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:34508 https://access.redhat.com/errata/RHSA-2026:34508

Comment 6 errata-xmlrpc 2026-07-22 12:54:59 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.19

Via RHSA-2026:40762 https://access.redhat.com/errata/RHSA-2026:40762