CVE-2026-53922: CWE-121: Stack-based Buffer Overflow in openwrt odhcpd

The odhcpd server in OpenWrt versions before 25.12.5 contains a stack-based buffer overflow triggered by a crafted DHCPv6 RENEW message with multiple IA_NA options. The vulnerability arises from an integer underflow in the handling of IA options that disables length checks, permitting attacker-controlled IA_ADDR serialization beyond the allocated 512-byte stack buffer. This leads to stack canary detection and termination of the odhcpd process, causing denial of service by repeatedly disrupting DHCPv6 service. The flaw requires an unauthenticated attacker on the same link and does not result in code execution based on current observations.

An attacker on the same network link can cause a denial of service by crashing the odhcpd process repeatedly, disrupting DHCPv6 service availability. There is no evidence of code execution or data confidentiality/integrity impact. The disruption persists as the process is respawned by procd, leading to sustained service interruptions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, network administrators should consider limiting access to the DHCPv6 service from untrusted hosts on the same link to reduce exposure. Monitor vendor channels for updates and apply patches promptly once released.