CVE-2025-68468: 
Avahi vulnerability analysis and mitigation

CVE-2025-68468 is a reachable assertion vulnerability in Avahi, a system that facilitates service discovery on local networks via the mDNS/DNS-SD protocol suite. The flaw affects Avahi versions 0.9-rc2 and earlier, and was originally reported on February 23, 2025, with the security advisory published on January 12, 2026. An unauthenticated network attacker can crash avahi-daemon by sending unsolicited mDNS announcements containing CNAME resource records pointing to records with short TTLs; when those records expire, the daemon aborts. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly).

The root cause is an incorrect assertion in browse.c at line 298 of the lookup_multicast_callback function (CWE-617: Reachable Assertion). When avahi-daemon processes CNAME resource records that chain to records with different keys and short TTLs, the cache expiration path (elapse_func → remove_entry → avahi_multicast_lookup_engine_notify → lookup_multicast_callback) triggers the assertion avahi_key_equal(b->key, l->key), which fails because the CNAME resolution causes a key mismatch, resulting in SIGABRT. The fix, committed in f66be13, simply removes the incorrect assertion from browse.c:298 (GitHub Commit, GitHub Issue). Exploitation requires that a record browser (e.g., browsing for _ipp._tcp) be active on the target system at the time the crafted mDNS packet is received (GitHub Advisory).

Successful exploitation causes avahi-daemon to crash with SIGABRT, resulting in complete unavailability of the mDNS/DNS-SD service discovery functionality on the local network segment. There is no confidentiality or integrity impact — the vulnerability is a pure denial-of-service condition. Systems relying on Avahi for service discovery (e.g., printers, network shares, IoT devices using Bonjour/mDNS) would lose discovery capability until the daemon is restarted (GitHub Advisory, Feedly).

1. Reconnaissance: Identify hosts on the local network segment running avahi-daemon with an active record browser (e.g., browsing for _ipp._tcp.local). Tools like avahi-browse or passive mDNS traffic monitoring can reveal active browsers.
2. Craft malicious mDNS packet: Construct an unsolicited mDNS response containing a CNAME chain with mismatched TTLs — for example, _ipp._tcp.local CNAME A.local (TTL=10), A.local CNAME B.local (TTL=10), and B.local PTR _qotd._tcp.local (TTL=2).
3. Send the packet using Scapy: Transmit the crafted packet to the mDNS multicast address using the following command (replace iface with the target interface name):

send(IP(dst='224.0.0.251%iface')/UDP(sport=5353,dport=5353)/DNS(qd=[],qr=1,an=[DNSRR(rrname='_ipp._tcp.local', type='CNAME', ttl=10, rdata='A.local'),DNSRR(rrname='A.local', type='CNAME', ttl=10, rdata='B.local'),DNSRR(rrname='B.local',type='PTR',ttl=2,rdata='_qotd._tcp.local')]))

4. Wait for TTL expiration: After the short-TTL record (e.g., 2 seconds) expires, avahi-daemon's cache expiration logic triggers the assertion failure in lookup_multicast_callback, causing the daemon to abort with SIGABRT.
5. Result: avahi-daemon crashes, disabling mDNS service discovery on the target host until the service is restarted (GitHub Advisory).

• Network: Unsolicited mDNS responses (UDP port 5353, destination 224.0.0.251) containing CNAME chains with mixed TTL values (e.g., one record with TTL ≤ 2 seconds and others with TTL ~10 seconds); mDNS packets with CNAME records pointing to PTR records for unrelated service types.
• Logs: System logs (e.g., /var/log/syslog or journalctl) showing avahi-daemon crash entries such as browse.c:298: lookup_multicast_callback: Assertion 'avahi_key_equal(b->key, l->key)' failed; repeated avahi-daemon restarts by systemd or init.
• Process: Unexpected termination of the avahi-daemon process with signal 6 (SIGABRT); core dump files generated by avahi-daemon in the system's core dump directory (GitHub Advisory, GitHub Issue).

Upgrade Avahi to version 0.9-rc3 or the stable release v0.9, which removes the incorrect assertion in browse.c (GitHub Commit). Microsoft has released patched packages for CBL-Mariner 2 (cbl2_avahi_0.8-5 patched) and Azure Linux 3 (azl3_avahi_0.8-5, 0.8-6, 0.8-7 patched) (Microsoft MSRC). Red Hat has issued RHSA-2026:11316, SUSE has released updates, and Mageia has published MGASA-2026-0016. As a temporary workaround where patching is not immediately possible, disabling avahi-daemon or restricting mDNS traffic at the network perimeter can reduce exposure, though this will also disable legitimate service discovery functionality.

The vulnerability was reported by the Avahi maintainer (evverx) via GitHub Issue #683 on February 23, 2025, and a security advisory was published on January 12, 2026 (GitHub Advisory). Multiple Linux distributions including SUSE, Red Hat, Mageia, Ubuntu, and Yocto Project have issued security advisories and updates, indicating broad ecosystem attention (Feedly). The vulnerability has been covered by security tracking sites including Tenable (multiple Nessus plugins: 282613, 294829, 296995, 297091) and Qualys, reflecting standard industry response to a medium-severity open-source daemon vulnerability.