CVE-2026-14258 Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling

Medium 6.5 Published 1 Jul 2026 Updated 12 Aug 2026

A remote attacker can cause a denial of service in dhcpcd by sending a crafted IPv6 Router Advertisement with a zero-length option, leading to an infinite loop.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-14258?

CVE-2026-14258 is a medium-severity denial of service vulnerability in Red Hat Enterprise Linux 10, published on 1 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.

Weakness: CWE-835

Which versions are affected by CVE-2026-14258?

Linux distribution packages (5)

`dhcpcd` AlmaLinux:10	All versions	`10.0.6-11.el10_2`
`dhcpcd` Red Hat:enterprise_linux:10.2	All versions	`0:10.0.6-11.el10_2`
`dhcpcd-debuginfo` Red Hat:enterprise_linux:10.2	All versions	`0:10.0.6-11.el10_2`
`dhcpcd-debugsource` Red Hat:enterprise_linux:10.2	All versions	`0:10.0.6-11.el10_2`
`dhcpcd` Rocky Linux:10	All versions	`0:10.0.6-11.el10_2`

How do I fix CVE-2026-14258?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-14258 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-14258 exists.

Sources

Also known as ALSA-2026:54210, AZL-91710, BELL-CVE-2026-14258, DEBIAN-CVE-2026-14258, GHSA-hm5v-wwxq-27x8, RHSA-2026:54210 and 2 more.