A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing

CVE-2026-14258 is a CWE-835 infinite loop in dhcpcd's IPv6 Neighbor Discovery Router Advertisement parser. A malformed RA option (classically a zero-length option TLV, or a crafted prefix/RDNSS/DNSSL block) causes the option-walk loop to fail to advance, spinning the daemon until it consumes CPU and stops servicing lease renewal. Affected are dhcpcd builds prior to the July 2026 fix in the NetworkConfiguration/dhcpcd tree — practically speaking, most 9.x and 10.x point releases shipped by Alpine, Gentoo, NetBSD, ChromeOS, and Raspberry Pi OS until distro backports land.

The CVSS breakdown — AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — is honest. Adjacent means Layer-2 reach, not internet-reachable. No confidentiality or integrity impact. Only availability. Vendor MEDIUM (6.5) is defensible; if anything the real-world number is slightly lower because most enterprise access networks either run RA Guard or don't run IPv6 stateless autoconfig at all on managed segments.

Why this verdict

• Vector is Adjacent, not Network. IPv6 ND is link-local by protocol design (hop-limit 255 check). No internet-facing exposure is possible. This alone caps severity below HIGH.
• Impact is availability-only. C:N/I:N/A:H — no memory corruption, no code execution, no data exposure. The worst outcome is dhcpcd pegging a core and losing lease renewal.
• Friction: RA Guard is a widely deployed control on enterprise access switches (Cisco, Aruba, Juniper all ship it). Where deployed, the malicious RA never reaches the victim.
• Role multiplier — workstation/laptop role: chain succeeds → user loses network on lease expiry, self-heals on daemon restart. Blast radius = single host, transient.
• Role multiplier — server role: most Linux servers do not run dhcpcd (systemd-networkd, NetworkManager, or static config dominate). Where dhcpcd is present (Alpine containers, Raspberry Pi appliances), servers usually have static IPv6 or IPv6 disabled. Blast radius = single host availability.
• Role multiplier — edge/IoT gateway role (highest realistic): ChromeOS, OpenWrt-adjacent, Raspberry Pi appliances. Chain succeeds → gateway loses upstream config. Blast radius still bounded to the appliance itself; no pivot, no identity, no data plane compromise. This does not trip the HIGH floor because the outcome is not fleet-scale or identity-scale.
• No KEV, no known exploitation, EPSS effectively zero — no urgency multiplier.

Why not higher?

HIGH would require either a code execution path, a fleet-scale blast radius, or active exploitation. This bug has none: it is a local CPU spin on a client-side daemon, reachable only from the same L2 segment, with no lateral movement primitive. Even a domain controller running dhcpcd (vanishingly rare) would only lose its dynamic IPv6 lease — AD services continue on the existing address.

Why not lower?

LOW would ignore the fact that the attacker requirements are trivial once on-segment (any guest Wi-Fi, any rogue device in a conference room, any compromised endpoint on the user VLAN), and that the outage can be sustained cheaply. On Alpine/ChromeOS/Raspberry Pi fleets the affected population is real and non-trivial, so this is not backlog hygiene — it earns a MEDIUM patch cycle.

1. Enable RA Guard on access switches — RFC 6105 first-hop security drops Router Advertisements sourced from non-authorized ports. On Cisco: ipv6 nd raguard policy and apply to access interfaces. On Aruba/Juniper equivalent. This neutralizes the delivery vector for every RA-based bug, not just this one. Deploy per noisgate mitigation SLA — no formal MEDIUM SLA, treat as standard hardening within the 365-day remediation window.
2. Inventory dhcpcd installs and disable IPv6 ND where not needed — Add noipv6rs or noipv6 to /etc/dhcpcd.conf on hosts that only need IPv4 leasing. Kills the parser exposure entirely.
3. Configure dhcpcd under a supervisor with rate-limited restart — systemd unit with Restart=on-failure and StartLimitBurst=3 — combined with a watchdog that kills the daemon when CPU >95% for >60s, this bounds the outage window and forces the attacker to sustain the flood.
4. Switch to systemd-networkd or NetworkManager on servers — Where dhcpcd is not architecturally required (most non-Alpine/non-Pi installs), removing the package removes the bug. Track via package inventory queries.

Run on each Linux/BSD target host as root or via your config-management runner (Ansible/Salt). Example: sudo ./check-cve-2026-14258.sh. Compares installed dhcpcd version against the fixed baseline and reports VULNERABLE / PATCHED / UNKNOWN.

#!/usr/bin/env bash
# noisgate check: CVE-2026-14258 — dhcpcd IPv6 ND RA infinite loop (CWE-835)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN/NOT_INSTALLED
set -u

FIXED_VERSION="10.2.4"  # placeholder — replace with the exact fixed release tag from your distro

if ! command -v dhcpcd >/dev/null 2>&1; then
  echo "UNKNOWN: dhcpcd not present on this host"
  exit 2
fi

RAW=$(dhcpcd --version 2>/dev/null | head -n1 || true)
VER=$(echo "$RAW" | grep -oE '[0-9]+(\.[0-9]+){1,3}' | head -n1)

if [ -z "$VER" ]; then
  echo "UNKNOWN: could not parse dhcpcd version from: $RAW"
  exit 2
fi

# semver-ish compare
vercmp() {
  # returns 0 if $1 >= $2
  [ "$1" = "$2" ] && return 0
  printf '%s\n%s\n' "$2" "$1" | sort -V -C && return 0 || return 1
}

# Check if IPv6 ND is actually processed (mitigating config)
ND_DISABLED="no"
if [ -f /etc/dhcpcd.conf ] && grep -qE '^\s*(noipv6rs|noipv6)\b' /etc/dhcpcd.conf; then
  ND_DISABLED="yes"
fi

if vercmp "$VER" "$FIXED_VERSION"; then
  echo "PATCHED: dhcpcd $VER >= $FIXED_VERSION"
  exit 0
else
  if [ "$ND_DISABLED" = "yes" ]; then
    echo "PATCHED (mitigated): dhcpcd $VER is vulnerable but IPv6 RS/RA processing is disabled in dhcpcd.conf"
    exit 0
  fi
  echo "VULNERABLE: dhcpcd $VER < $FIXED_VERSION and IPv6 ND processing is enabled"
  exit 1
fi

Sources

1. NetworkConfiguration/dhcpcd upstream
2. Contiki-NG IPv6 ND infinite loop advisory (analogous bug class)
3. RFC 6105 — IPv6 RA Guard
4. RFC 3756 — IPv6 ND Trust Models and Threats
5. IETF: Security Assessment of ND for IPv6
6. F5 K9528 — NDP vulnerability reference
7. MITRE CWE-835 — Loop with Unreachable Exit Condition
8. Cisco IPv6 ND crafted packet DoS advisory (bug-class precedent)