CVE-2026-18103: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-18103 is a classic buffer overflow vulnerability in the dhcp-server (ISC DHCP / dhcpd) affecting the print_hw_addr() function, triggered via the OMAPI (Open Management Application Programming Interface) port. A remote attacker with network access to the OMAPI port (TCP 7911) can send a specially crafted lease creation request containing an overly long InfiniBand MAC address, causing a persistent denial of service. The vulnerability was published on August 5, 2026, and was discovered by Martin Osvald of Red Hat. Affected products include Red Hat Enterprise Linux distributions shipping dhcp-server. It carries a CVSS v3.1 base score of 4.9 (Medium), though Red Hat classifies its impact as Moderate (Red Hat Advisory, Github Advisory).

The root cause is CWE-120 (Buffer Copy without Checking Size of Input — Classic Buffer Overflow): the print_hw_addr() function in dhcpd does not validate the length of the hardware address field before copying it into a fixed-size buffer. An attacker exploits this by sending a crafted OMAPI lease creation request with an excessively long InfiniBand MAC address to port 7911. If TSIG (Transaction Signature) key authentication is not configured on the OMAPI interface, no credentials are required beyond network access to the port. Successful exploitation causes dhcpd to crash and write a malformed lease entry to /var/lib/dhcpd/dhcpd.leases, which prevents the service from restarting automatically without manual removal of the bad entry (Red Hat Advisory, Github Advisory).

Successful exploitation results in a persistent denial of service: the dhcpd service crashes and cannot restart without manual administrator intervention to remove the malformed InfiniBand lease entry from /var/lib/dhcpd/dhcpd.leases. This disrupts DHCP services for all network clients relying on the affected server, potentially causing widespread network connectivity loss in environments where DHCP is critical infrastructure. There is no confidentiality or integrity impact — the vulnerability is limited to availability (Red Hat Advisory).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The EPSS score is approximately 0.4% (33rd percentile), indicating a low near-term exploitation probability. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the requirement for high privileges or an unsecured OMAPI port. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus detection (plugin 332066) is available for scanning (Red Hat Advisory).

1. Reconnaissance: Identify hosts running dhcpd with the OMAPI port (TCP 7911) exposed to the network using a port scanner such as Nmap (nmap -p 7911 <target>).
2. Assess authentication: Determine whether TSIG key authentication is configured on the OMAPI interface. If not configured, no credentials are required to interact with the OMAPI service.
3. Craft malicious OMAPI request: Construct a lease creation request via the OMAPI protocol that includes an InfiniBand hardware address field with an excessively long value exceeding the buffer size expected by print_hw_addr().
4. Send the request: Transmit the crafted OMAPI message to port 7911 on the target server. Tools such as omshell (the ISC DHCP OMAPI shell client) or a custom script can be used to interact with the OMAPI interface.
5. Trigger crash: The oversized InfiniBand MAC address triggers a buffer overflow in print_hw_addr(), causing dhcpd to crash. The malformed lease is written to /var/lib/dhcpd/dhcpd.leases.
6. Persistent DoS achieved: The dhcpd service fails to restart automatically due to the corrupted lease file, requiring manual administrator intervention to restore service (Red Hat Advisory).

• Network: Unexpected or repeated TCP connection attempts to port 7911 (dhcpd OMAPI port) from untrusted or external IP addresses; OMAPI traffic containing unusually large hardware address fields.
• Logs: System logs (/var/log/messages, journalctl) showing dhcpd crash events (segmentation fault or similar); repeated failed dhcpd restart attempts by systemd or init.
• File System: Presence of a malformed InfiniBand lease entry in /var/lib/dhcpd/dhcpd.leases with an abnormally long hardware address field; dhcpd core dump files in the working directory.
• Process: Absence of a running dhcpd process on a server that should be providing DHCP services; systemd reporting dhcpd.service in a failed state (Red Hat Advisory).

The primary mitigation is to configure TSIG key authentication on the OMAPI interface to require authentication for all lease creation requests, preventing unauthenticated access to port 7911. If OMAPI is not operationally required, disable it entirely in the dhcpd configuration. Firewall rules should restrict access to TCP port 7911 to trusted management hosts only. If the dhcpd service has already crashed due to this flaw, manually remove the malformed InfiniBand lease entry from /var/lib/dhcpd/dhcpd.leases before restarting the service — note that restarting dhcpd will temporarily interrupt DHCP services for clients. A vendor patch has been indicated as available; organizations should monitor Red Hat errata for updated dhcp-server packages for their specific RHEL versions (Red Hat Advisory, Github Advisory).

The vulnerability was discovered internally by Martin Osvald of Red Hat and reported via Red Hat Bugzilla (Bug 2508081). Red Hat classifies the impact as Moderate, noting that exploitation requires network access to the OMAPI port and is significantly mitigated by TSIG authentication. No notable independent researcher commentary or significant social media discussion has been observed beyond standard vulnerability aggregator coverage (Red Hat Advisory).