Bug 2536079 (CVE-2026-93008)

Summary:	CVE-2026-93008 dnsmasq: dnsmasq: out-of-bailiwick cache injection through CNAME chase in split-DNS configurations
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, amctagga, aoconnor, aos-team-art-private, asdas, bniver, dpaolell, eglynn, flucifre, gmeno, groman, jdelft, jjoyce, jpretori, jschluet, jupierce, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, sostapov, suppawar, vereddy, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-17 14:52:25 UTC

An insufficient authenticity check was found in dnsmasq's DNS CNAME chase logic in src/rfc1035.c. When a response contains a CNAME, dnsmasq replaces the tracked query name with the CNAME target and rescans the answer section (cname_loop), then cache_insert()s matching records. There is no bailiwick validation that those records fall within the responding server's zone of authority. Source inspection finds no bailiwick checks anywhere in dnsmasq.

In split-DNS configurations (server=/domain/ip), this lets an attacker who controls a delegated upstream inject a CNAME to an unrelated name plus a forged address record. dnsmasq caches the forged record for all clients, escaping the server=/domain/ containment boundary.

A related issue exists in find_soa() (rfc1035.c), introduced in v2.90 (commit 12ddb2a4): SOA suffix matching uses raw memcmp without a DNS label-boundary check, unlike in_zone() and domain_no_rebind().

F3a (missing bailiwick on CNAME chase): all versions.
F3b (find_soa label-boundary): v2.90 onwards.
Fix: Not yet available (reporter coordinating with upstream).
Reporter: Shubham Raj (Causal Security)
PSIRT Ticket: PSIRTSUPT-23743