Heap Use-After-Free Vulnerability in dhcpcd by NetworkConfiguration

CVE-2026-56117

What is CVE-2026-56117?

The dhcpcd software, up to version 10.3.2, is affected by a heap use-after-free vulnerability in the handling of its control socket. When privilege separation is disabled, a local unprivileged attacker can exploit this flaw. By connecting to the control socket and sending certain privileged commands, the attacker can trigger memory corruption. This occurs because the control_recvdata() function frees the client object, while a subsequent READ+HANGUP event leads to a call to control_hangup() utilizing a now-invalid pointer. This condition allows for potential exploitation, particularly in configurations where privilege separation is either disabled or has failed.

References