Bug 2536075 (CVE-2026-93006)

Summary:	CVE-2026-93006 dnsmasq: dnsmasq: TFTP prefetch cache keyed on stale heap pointer serves wrong file content
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, amctagga, aoconnor, aos-team-art-private, asdas, bniver, dpaolell, eglynn, flucifre, gmeno, groman, jdelft, jjoyce, jpretori, jschluet, jupierce, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, sostapov, suppawar, vereddy, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-17 14:45:33 UTC

A use-after-free cache-key confusion was found in dnsmasq's TFTP prefetch path in get_block() (src/tftp.c). The prefetch cache uses daemon->srv_save (a void* pointer to the tftp_transfer struct) and a static saved_offset as cache keys. When a transfer completes, free_transfer() frees the transfer struct without clearing daemon->srv_save, leaving a dangling pointer as a valid cache key.

If a later TFTP transfer is allocated at the same heap address (common after free+malloc of the same size) and the new transfer's offset matches saved_offset, get_block() returns previously cached file content from daemon->packet without reading the new client's file from disk. In a PXE environment this can substitute attacker-controlled file content for a victim's boot file.

The cache check compares only pointer identity and offset. It does not verify filename, inode, file descriptor, or client identity. daemon->srv_save is shared with DNS forwarding, so DNS activity overwrites the TFTP cache key and accidentally mitigates the bug in mixed DNS/TFTP deployments.

Compile-time gate: HAVE_TFTP is defined by default (src/config.h). Runtime gate: --enable-tftp. Exploitation is deterministic when DNS is inactive and clients do not negotiate TFTP options (the OACK path clears srv_save).

Affected versions: v2.92 through HEAD. Introducing commit: ee09f06 (Optimise tftp). Unaffected: v2.91 and earlier (no saved_offset prefetch cache).
Fix: Not yet available (reporter coordinating with upstream).
Reporter: Shubham Raj (Causal Security)
PSIRT Ticket: PSIRTSUPT-23743