CVE-2026-4893: 
dnsmasq vulnerability analysis and mitigation

CVE-2026-4893 is an information disclosure vulnerability in dnsmasq that allows remote, unauthenticated attackers to bypass source validation checks by sending a crafted DNS packet containing RFC 7871 (EDNS Client Subnet, ECS) information. It was discovered by Royce M and disclosed on May 11, 2026, as part of a coordinated release covering six dnsmasq CVEs (VU#471747). The vulnerability affects dnsmasq versions up to and including 2.92 (specifically when --add-subnet is enabled); dnsmasq 2.92rel2 addresses the flaw. It carries a CVSS v3.1 base score of 5.3 (Medium) (CERT/CC VU#471747, Github Advisory).

The root cause lies in process_reply() passing the OPT record length (~23 bytes) to check_source() instead of the full packet length when the --add-subnet option is enabled. This causes every internal bounds check within the validation routine to fail, making the function always return success and effectively disabling ECS source validation as specified in RFC 7871 §9.2. An attacker can craft a DNS packet with a malicious RFC 7871 client subnet option to bypass source checks, potentially enabling cache poisoning or silent redirection of DNS responses. No specific CWE has been formally assigned, but the flaw is consistent with improper input validation (CWE-20) or incorrect bounds checking. A PoC repository (github.com/lottiedeyan/CVE20264893poc) has been observed in threat intelligence feeds (CERT/CC VU#471747, Pi-hole FTL v6.6.2).

Successful exploitation allows an unauthenticated remote attacker to bypass ECS source validation, which can lead to information disclosure of internal network topology (via client subnet data) and facilitate DNS cache poisoning or response redirection to attacker-controlled addresses. The confidentiality impact is limited (CVSS C:L), with no direct integrity or availability impact from this CVE alone; however, in combination with other dnsmasq vulnerabilities disclosed simultaneously (e.g., CVE-2026-2291), the risk of DNS redirection and user traffic interception is elevated. Affected deployments include home routers, embedded networking devices, Pi-hole instances, and any Linux distribution shipping dnsmasq with --add-subnet enabled (CERT/CC VU#471747, Github Advisory).

As of the time of disclosure, no confirmed in-the-wild exploitation has been observed, and no public proof-of-concept was initially available; however, a PoC repository (github.com/lottiedeyan/CVE20264893poc) appeared in threat intelligence feeds shortly after disclosure. The EPSS score is approximately 0.049% (low probability of exploitation within 30 days). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires no authentication and no user interaction, but does require the target dnsmasq instance to have --add-subnet enabled (Github Advisory, CERT/CC VU#471747).

1. Reconnaissance: Identify dnsmasq instances (version < 2.92rel2) exposed to the network using tools like Shodan, Censys, or active DNS probing. Confirm the target has --add-subnet (ECS) enabled by observing ECS options in DNS responses.
2. Craft malicious DNS packet: Construct a DNS query or response packet that includes a crafted RFC 7871 EDNS Client Subnet (ECS) OPT record with a manipulated option length field designed to cause process_reply() to pass the OPT record length (~23 bytes) to check_source() instead of the full packet length.
3. Send crafted packet: Transmit the crafted DNS packet to the target dnsmasq resolver. Because the bounds check always returns success, the source validation is bypassed.
4. Achieve objective: With source validation bypassed, the attacker can inject or manipulate DNS responses, potentially poisoning the dnsmasq cache to redirect users to attacker-controlled IP addresses, or disclose client subnet information about internal network clients (CERT/CC VU#471747, Pi-hole FTL v6.6.2).

• Network: Unexpected DNS responses containing RFC 7871 ECS OPT records from untrusted or external sources; DNS queries returning anomalous or unexpected IP addresses for known domains; unusual DNS traffic patterns targeting dnsmasq resolvers.
• Logs: dnsmasq log entries showing DNS responses accepted from unexpected source addresses; repeated DNS resolution failures or unexpected cache entries for known-good domains in /var/log/syslog or dnsmasq-specific logs.
• File System: Presence of PoC or exploit scripts referencing CVE-2026-4893 (e.g., files from github.com/lottiedeyan/CVE20264893poc) on systems that interact with the dnsmasq host.
• Process: dnsmasq process running with --add-subnet flag visible in process listings (ps aux | grep dnsmasq) on unpatched versions (< 2.92rel2).

The primary remediation is to upgrade dnsmasq to version 2.92rel2, which was released on May 11, 2026, and contains fixes for all six disclosed CVEs including CVE-2026-4893 (CERT/CC VU#471747). Distribution-specific patches are available for Ubuntu (USN-8268-1), Red Hat (RHSA-2026:19158, RHSA-2026:19373, RHSA-2026:20589), Debian (DSA-6264-1, DLA-4625-1), SUSE, Slackware (SSA-2026-135-01), Mageia (MGASA-2026-0135), Amazon Linux, and others. Pi-hole users should update to FTL v6.6.2 (Pi-hole FTL v6.6.2). As a workaround where immediate patching is not possible, disable the --add-subnet option in dnsmasq configuration and restrict DNS query access to trusted networks only.

The vulnerability was part of a coordinated disclosure involving six dnsmasq CVEs, coordinated by CERT/CC (VU#471747) with involvement from multiple Linux distributions and device vendors. Help Net Security covered the disclosure, and the r/pihole and r/SecOpsDaily Reddit communities discussed the impact on home networking devices and Pi-hole deployments. ISPreview.co.uk highlighted the risk to UK broadband routers. The dnsmasq maintainer Simon Kelly and Pi-hole's DL6ER responded promptly with patches, and The Hacker News included the dnsmasq vulnerabilities in its weekly security recap (CERT/CC VU#471747, Help Net Security).