CVE-2026-14258 is a vulnerability in the dhcpcd daemon's handling of IPv6 Neighbor Discovery Router Advertisements. A crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option bypasses initial validation and is stored for later reparsing without adequate checks. This causes the parser to enter an infinite loop consuming excessive CPU resources, resulting in denial of service. The root cause is inconsistent validation logic during Router Advertisement processing. Red Hat addressed this issue in dhcpcd version 10.2.0 by discarding malformed Router Advertisements immediately and further strengthened validation in subsequent commits. The vulnerability affects Red Hat Enterprise Linux 10 and Red Hat In Vehicle OS products that ship dhcpcd with IPv6 Router Advertisement processing enabled.

Successful exploitation requires an adjacent unauthenticated attacker on the same Layer-2 network segment to send a malicious IPv6 Router Advertisement. No user interaction or authentication is needed. Exploitation causes dhcpcd to repeatedly process the malformed packet, leading to excessive CPU utilization and denial of service. There is no impact on confidentiality or integrity. The CVSS v3.1 base score is 6.5 (Medium severity) with an attack vector of adjacent network, low attack complexity, no privileges required, and no user interaction.

Red Hat has released an official security update fixing this vulnerability in dhcpcd for Red Hat Enterprise Linux 10. Administrators should apply the updated dhcpcd packages (e.g., dhcpcd-10.0.6-11.el10_2) as soon as possible. Until patches are applied, mitigation options include disabling IPv6 Router Advertisement processing on interfaces where it is not required or restricting acceptance of untrusted ICMPv6 Router Advertisements via network filtering. Systems relying on IPv6 Stateless Address Autoconfiguration or Router Advertisement-based configuration should evaluate operational impact before applying these mitigations.