CVE-2026-56116: 
NixOS vulnerability analysis and mitigation

CVE-2026-56116 is a memory leak vulnerability in dhcpcd's IPv6 Router Advertisement route information handling that allows an unauthenticated attacker on the same network link to cause a denial of service. It affects dhcpcd through version 10.3.2 and was fixed in commit 708b4a5. The vulnerability was published on June 23, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-772 (Missing Release of Resource after Effective Lifetime). The vulnerability exists in the routeinfo_findalloc() function within src/ipv6nd.c, which allocates memory for Route Information options parsed from IPv6 Router Advertisement (RA) messages but fails to free that memory when the route expires — specifically when the Route Information option carries a lifetime value of zero. The fix, introduced in commit 708b4a5, adds a single free(rinfo) call after removing the expired route info entry from the TAILQ linked list, confirming the trivial but impactful nature of the omission (GitHub Commit, GitHub Advisory). An attacker must be on the same Layer 2 network segment as the target to send crafted RA packets; no authentication or privileges are required.

Successful exploitation causes linear memory exhaustion in the dhcpcd daemon, ultimately leading to a daemon crash and loss of DHCP/IPv6 network configuration management on the affected host. The impact is limited to availability — there is no confidentiality or integrity impact, and no evidence of lateral movement potential beyond disrupting network connectivity on the affected system. Systems relying on dhcpcd for network configuration (common in embedded Linux, Alpine Linux, Arch Linux, and Yocto-based systems) would lose network connectivity until the daemon is restarted or the system is rebooted (GitHub Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify hosts on the local network segment running dhcpcd version 10.3.2 or earlier with IPv6 enabled, using network scanning tools such as nmap with IPv6 support or passive traffic analysis.
2. Craft malicious Router Advertisement packets: Construct ICMPv6 Router Advertisement messages containing Route Information options (RFC 4191, type 24) with the route lifetime field set to zero. Tools such as scapy (Python) can be used to craft these packets: set the ICMPv6NDOptRouteInfo lifetime to 0 within an ICMPv6ND_RA packet.
3. Send packets repeatedly: Transmit the crafted RA packets from a host on the same Layer 2 segment to the all-nodes multicast address (ff02::1) or directly to the target's link-local address, repeatedly and at high frequency to accelerate memory exhaustion.
4. Trigger memory leak: Each received RA with a zero-lifetime Route Information option causes routeinfo_findalloc() to allocate memory that is never freed, incrementally exhausting the dhcpcd process's heap.
5. Achieve denial of service: After sufficient iterations, the dhcpcd daemon runs out of memory and crashes, disrupting network configuration management on the target host (GitHub Commit, GitHub Advisory).

• Network: Unusual volume of ICMPv6 Router Advertisement packets (type 134) originating from an unexpected source on the local link, particularly containing Route Information options (option type 24) with a lifetime of zero; traffic analyzable via tcpdump -i <iface> icmp6 or Wireshark filter icmpv6.type == 134.
• Process: Steadily increasing memory consumption by the dhcpcd process observable via top, ps aux, or /proc/<pid>/status; eventual unexpected termination or crash of the dhcpcd daemon.
• Logs: System logs (/var/log/syslog, journalctl -u dhcpcd) showing dhcpcd crash messages, OOM killer events targeting dhcpcd, or repeated restarts of the dhcpcd service; kernel logs may show Out of memory: Kill process entries referencing dhcpcd.
• File System: Core dump files generated by dhcpcd crash in /var/crash/ or the working directory of the daemon, if core dumps are enabled.

The fix is available in commit 708b4a5 of the dhcpcd repository; users should update to any version of dhcpcd newer than 10.3.2 that includes this commit (GitHub Commit). As a network-level workaround, administrators can implement RA Guard (IEEE 802.1aq / RFC 6105) on managed switches to restrict which ports are permitted to send Router Advertisement messages, preventing unauthorized RA injection from attacker-controlled hosts. Additionally, restricting network access to trusted sources on the same link segment reduces exposure until a patched version can be deployed (GitHub Advisory).

Red Hat has tracked the vulnerability via Bugzilla (Bug 2491824) with a medium priority/severity rating, and the Yocto Project security mailing list has also noted the issue. No significant public researcher commentary, vendor statements beyond the patch commit, or notable media coverage has been identified for this vulnerability.