Bug 2536083 (CVE-2026-93009)

Summary:	CVE-2026-93009 dnsmasq: dnsmasq: heap out-of-bounds read in DHCPv6 option 39 FQDN decoder
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	akhatavk, amctagga, aoconnor, aos-team-art-private, asdas, bniver, dpaolell, eglynn, flucifre, gmeno, groman, jdelft, jjoyce, jpretori, jschluet, jupierce, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, sostapov, suppawar, vereddy, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-17 14:54:43 UTC

A one-byte heap out-of-bounds read was found in dnsmasq's DHCPv6 OPTION_CLIENT_FQDN (option 39) decoder in src/rfc3315.c. The label-parsing loop evaluates while (*op != 0 && bounds), dereferencing *op before checking that op is still within the option data. If labels exactly fill the option payload with no trailing NUL, op lands one byte past the option and the next iteration reads that byte.

The OOB byte is used only as a loop-termination condition. It is not returned to the client, logged, or stored. No crash or information leak was demonstrated. HAVE_DHCP6 is compiled by default. Attack vector is adjacent (DHCPv6 link-local).

Affected versions: v2.61 through HEAD. Introducing commit: fbbc1454 (Fix off-by-one in DHCPv6 FQDN option decoding), which left a residual off-by-one in the termination condition. Unaffected: v2.60 and earlier.
Fix: Not yet available (reporter coordinating with upstream).
Reporter: Shubham Raj (Causal Security)
PSIRT Ticket: PSIRTSUPT-23743