CVE-2026-56116 describes a memory leak in the dhcpcd daemon (up to version 10.3.2) related to handling IPv6 Router Advertisement route information. Specifically, when Router Advertisements contain Route Information options with a lifetime of zero, the function routeinfo_findalloc() fails to free allocated memory properly. An unauthenticated attacker on the same network link can exploit this by repeatedly sending such crafted Router Advertisements, causing the dhcpcd process to consume increasing memory until it crashes, resulting in denial of service. The vulnerability was fixed in commit 708b4a5, but no official patch or remediation level is provided in the data.

The vulnerability allows an unauthenticated attacker on the same local network segment to cause a denial of service by crashing the dhcpcd daemon through memory exhaustion. This disrupts network configuration services relying on dhcpcd, potentially impacting network availability for affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in commit 708b4a5, which suggests a fix exists but no official patch or release information is provided. Until an official patch is available, limit exposure by restricting access to trusted network segments and monitoring for suspicious Router Advertisements.