A flaw in dhcpcd’s IPv6 Router Advertisement handling allows an attacker to craft a packet containing a zero-length Neighbor Discovery option. The packet bypasses initial validation, and when the client later parses it, a loop that never advances consumes CPU cycles indefinitely, leading to a denial-of-service condition characterized by excessive processor usage. Although the title mentions an out-of-bounds read, the official description focuses on the infinite loop and CPU exhaustion; no memory corruption has been reported.

Red Hat Enterprise Linux 10 systems that ship the stock dhcpcd package. All installations of dhcpcd on RHEL 10 are vulnerable; no sub‑version boundaries are specified.

The CVSS score of 6.5 indicates a medium severity exploit. The EPSS score of less than 1% shows a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based: an adversary who can inject ICMPv6 Router Advertisements onto an interface that accepts them can trigger the denial‑of‑service. The attack requires the target to process Router Advertisements, so disabling or filtering these packets removes the attack surface.