Bug 2571616 (CVE-2026-124740)

Summary: CVE-2026-124740 busybox: Use-after-free of requested_ipv6 in udhcpc6
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by responding with a crafted Dynamic Host Configuration Protocol for IPv6 (DHCPv6) reply packet lacking usable address options. This issue causes the client to read stale heap memory, which can result in a Denial of Service (DoS) due to an application crash or disclose previously assigned network address data in subsequent discovery requests.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-11 09:39:54 UTC 
A flaw was found in BusyBox's udhcpc6. The requested_ipv6 pointer references a heap copy of the IA_NA option that is freed on every Reply before the new one is validated, and again in send_d6_discover() just before the pointer is read. A malicious DHCPv6 server on the link can trigger this use-after-free with a Reply lacking a usable IA_NA or IA_PD, causing a 16-byte stale heap read; the stale value, typically the previously assigned address, is then sent in the next Discover. Under hardened allocators this may cause the client to crash.