A memory leak exists in dhcpcd’s handling of IPv6 Router Advertisement route information. When the daemon receives a crafted Router Advertisement that contains Route Information options with a lifetime of zero, the routine that allocates memory for route entries fails to free memory. Repeated exploitation causes linear growth of memory usage until the system eventually crashes.

The vulnerability affects NetworkConfiguration’s dhcpcd version 10.3.2 and earlier. The patch included in commit 708b4a56 resolves the issue.

The CVSS score of 7.1 indicates a medium severity. EPSS is unavailable and the vulnerability is not listed in CISA KEV. Because the attack requires an attacker to be on the same link as the target and to send Router Advertisements, the threat is local. An attacker with local network access can repeatedly trigger the memory leak, leading to a denial of service of the dhcpcd daemon and resulting network disruption on the affected host.