Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:dhcpcd
User: [email protected]
Usertags: pu
[ Reason ]
Backporting a fix for one minor CVE reported on the Debian security tracker.
CVE-2026-14258 was fixed in 10.2.0 (Sid has 10.3.2) but never backported until
now.
[ Impact ]
Without it, successful exploitation of the CVE may result in excessive CPU
consumption, leading to a denial of service.
[ Tests ]
Verified to boot on a host running Trixie.
[ Risks ]
Small. A few lines of code.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
dhcpcd (1:10.1.0-11+deb13u4) trixie; urgency=medium
.
* [patches]
+ Cherry-pick upstream fix for CVE-2026-14258 (commit 75289ca).
= Refresh all patches.
diff -Nru dhcpcd-10.1.0/debian/changelog dhcpcd-10.1.0/debian/changelog
--- dhcpcd-10.1.0/debian/changelog 2026-06-26 18:23:21.000000000 +0300
+++ dhcpcd-10.1.0/debian/changelog 2026-07-14 14:36:11.000000000 +0300
@@ -1,3 +1,11 @@
+dhcpcd (1:10.1.0-11+deb13u4) trixie; urgency=medium
+
+ * [patches]
+ + Cherry-pick upstream fix for CVE-2026-14258 (commit 75289ca).
+ = Refresh all patches.
+
+ -- Martin-Éric Racine <[email protected]> Tue, 14 Jul 2026 14:36:11
+0300
+
dhcpcd (1:10.1.0-11+deb13u3) trixie; urgency=medium
* [patches] (Closes: #1140767)
diff -Nru dhcpcd-10.1.0/debian/copyright dhcpcd-10.1.0/debian/copyright
--- dhcpcd-10.1.0/debian/copyright 2026-06-26 18:08:05.000000000 +0300
+++ dhcpcd-10.1.0/debian/copyright 2026-07-14 14:33:14.000000000 +0300
@@ -92,7 +92,7 @@
Files: debian/*
Copyright: 2023, Andreas Beckmann <[email protected]>
- 2022-2025, Martin-Éric Racine <[email protected]>
+ 2022-2026, Martin-Éric Racine <[email protected]>
2018, Scott Leggett <[email protected]>
2015, Daniel Echeverry <[email protected]>
2014, Salvatore Bonaccorso <[email protected]>
diff -Nru
dhcpcd-10.1.0/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch
dhcpcd-10.1.0/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch
--- dhcpcd-10.1.0/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch
1970-01-01 02:00:00.000000000 +0200
+++ dhcpcd-10.1.0/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch
2026-07-14 14:33:15.000000000 +0300
@@ -0,0 +1,71 @@
+From 75289ca54211481d21b0c915db98dd733b30794f Mon Sep 17 00:00:00 2001
+From: Roy Marples <[email protected]>
+Date: Sat, 7 Dec 2024 10:25:44 +0000
+Subject: [PATCH] IPv6: Discard NA packets with a zero length option
+
+As per RFC 4861 4.6.
+
+Fixes #415.
+---
+ src/ipv6nd.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+--- a/src/ipv6nd.c
++++ b/src/ipv6nd.c
+@@ -974,6 +974,12 @@
+ bool new_ia;
+ #endif
+
++#define FREE_RAP(rap) \
++ if (new_rap) \
++ ipv6nd_removefreedrop_ra(rap, 0, 0); \
++ else \
++ ipv6nd_free_ra(rap); \
++
+ if (ifp == NULL || RS_STATE(ifp) == NULL) {
+ #ifdef DEBUG_RS
+ logdebugx("RA for unexpected interface from %s", sfrom);
+@@ -1130,8 +1136,10 @@
+ memcpy(&ndo, p, sizeof(ndo));
+ olen = (size_t)ndo.nd_opt_len * 8;
+ if (olen == 0) {
++ /* RFC4681 4.6 says we MUST discard this ND packet. */
+ logerrx("%s: zero length option", ifp->name);
+- break;
++ FREE_RAP(rap);
++ return;
+ }
+ if (olen > len) {
+ logerrx("%s: option length exceeds message",
+@@ -1155,10 +1163,7 @@
+ else
+ logwarnx("%s: reject RA (option %d) from %s",
+ ifp->name, ndo.nd_opt_type, rap->sfrom);
+- if (new_rap)
+- ipv6nd_removefreedrop_ra(rap, 0, 0);
+- else
+- ipv6nd_free_ra(rap);
++ FREE_RAP(rap);
+ return;
+ }
+
+@@ -1409,10 +1414,7 @@
+ {
+ logwarnx("%s: reject RA (no option %s) from %s",
+ ifp->name, dho->var, rap->sfrom);
+- if (new_rap)
+- ipv6nd_removefreedrop_ra(rap, 0, 0);
+- else
+- ipv6nd_free_ra(rap);
++ FREE_RAP(rap);
+ return;
+ }
+ }
+@@ -1494,6 +1496,7 @@
+
+ /* Expire should be called last as the rap object could be destroyed */
+ ipv6nd_expirera(ifp);
++#undef FREE_RAP
+ }
+
+ bool
diff -Nru
dhcpcd-10.1.0/debian/patches/79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch
dhcpcd-10.1.0/debian/patches/79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch
--- dhcpcd-10.1.0/debian/patches/79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch
2026-06-26 18:13:59.000000000 +0300
+++ dhcpcd-10.1.0/debian/patches/79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch
2026-07-14 14:33:15.000000000 +0300
@@ -16,7 +16,7 @@
+++ b/src/dhcpcd.conf
@@ -34,11 +34,6 @@
# Most distributions have NTP support.
- option ntp_servers
+ #option ntp_servers
-# Rapid commit support.
-# Safe to enable by default because it requires the equivalent option set
diff -Nru
dhcpcd-10.1.0/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch
dhcpcd-10.1.0/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch
--- dhcpcd-10.1.0/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch
2026-06-26 18:13:58.000000000 +0300
+++ dhcpcd-10.1.0/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch
2026-07-14 14:33:15.000000000 +0300
@@ -15,5 +15,5 @@
-#option ntp_servers
+option ntp_servers
- # Rapid commit support.
- # Safe to enable by default because it requires the equivalent option set
+ # A ServerID is required by RFC2131.
+ require dhcp_server_identifier
diff -Nru dhcpcd-10.1.0/debian/patches/series
dhcpcd-10.1.0/debian/patches/series
--- dhcpcd-10.1.0/debian/patches/series 2026-06-26 18:13:25.000000000 +0300
+++ dhcpcd-10.1.0/debian/patches/series 2026-07-14 14:33:15.000000000 +0300
@@ -1,5 +1,4 @@
Debian_uncomment_hostname_in_dhcpcd_conf.patch
-Debian_uncomment_ntp_servers_dhcpcd_conf.patch
25689325f81c7a61bd48f5727eaae1d6f16e1328.patch
2870767a79537b5d6918e7de80358b406fea0898.patch
fdeb8c7945211d424c3a30912004eeb56e009865.patch
@@ -7,9 +6,15 @@
79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch
6acf895a66b143c42308777e085c1511cdebe5e0.patch
5db90127b1c3128480a52559a9cdbd4949a0fed4.patch
+#10.1.0-11+deb13u1
eac7152ec04f5a330f01ab9504514a03f873b35c.patch
+#10.1.0-11+deb13u2
+Debian_uncomment_ntp_servers_dhcpcd_conf.patch
+#10.1.0-11+deb13u3
117742d755b591764036dd4218f314f748a3d2b7.patch
2f00c7bfc408b6582d331932dfa47829c4819029.patch
5733d3c59a5651f64357ac11c98b4f39895c8d25.patch
708b4a56bae080a5b18c2e0c4c6fbe103131a2b0.patch
78ea09ed1633a583dbcde6e7bab9df4639ec8a34.patch
+#10.1.0-11+deb13u4
+75289ca54211481d21b0c915db98dd733b30794f.patch
