Buffer Underflow in DHCPv6 Server of OpenWrt's odhcpd

CVE-2026-53922

What is CVE-2026-53922?

The odhcpd DHCPv6 server in OpenWrt is susceptible to a buffer underflow vulnerability. An unauthenticated host on the same network segment can exploit this issue by obtaining DHCPv6 bindings and sending a specially crafted RENEW request containing multiple IA_NA options. This can lead to an underflow condition affecting the response buffer management, ultimately causing a denial of service for the DHCPv6 service. While the vulnerability does not lead to remote code execution, it disrupts the DHCPv6 service by making the odhcpd server terminate under certain conditions, necessitating process respawns.

References