CVE-2026-93009

A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.

This vulnerability is rated as Low because it is a 1-byte adjacent-network out-of-bounds read with no demonstrated leak or crash. The read value is used only to decide whether the parse loop continues. Red Hat products that ship dnsmasq with DHCPv6 compiled in may be affected when a DHCPv6 range is configured. RHEL 6 ships dnsmasq 2.48, which predates the introducing change. Later RHEL streams ship 2.76 or newer and include this parser.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The following measures reduce risk:

1. If DHCPv6 is not required, do not configure any IPv6 dhcp-range.
2. Compile without DHCPv6 using COPTS=-DNO_DHCP6 if IPv6 DHCP is not needed.
3. Restrict dnsmasq to trusted interfaces with --interface=<iface>.