Bug 2571617 (CVE-2026-124741)

Summary: CVE-2026-124741 busybox: Stack buffer overflow in udhcpc6 send_d6_renew() and send_d6_release()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copying them into memory. A malicious DHCPv6 server on the local network can exploit this flaw by sending a crafted reply, triggering a stack-based buffer overflow. This vulnerability could allow an attacker to achieve arbitrary code execution with root privileges or cause a denial of service (DoS) crash.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-11 09:44:21 UTC 
A flaw was found in BusyBox's udhcpc6. The server's SERVERID, IA_NA and IA_PD options are stored verbatim and later copied into a fixed-size struct d6_packet on the stack together with the client's own options, without a size check. A malicious DHCPv6 server on the link can send a Reply whose options cause the next Renew to write 34 bytes past the end of the stack object (Release overflows by 20), with content that is partially controlled by the server. This may cause the udhcpc6 process, which runs as root, to crash and could potentially lead to arbitrary code execution.