In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the… (CVE-2026-110912)

In DragonFly BSD versions through 6.4.2 before commit 4bb22ff, the ARP input handlers arpintr() and in_arpinput() in sys/netinet/if_ether.c fail to validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. The function in_arpreply() uses these attacker-controlled length values as memcpy lengths when copying from kernel buffers that are only 6 and 4 bytes long, leading to out-of-bounds reads of kernel heap and stack memory. This memory is then copied into the ARP reply sent back to the requester. An unauthenticated attacker on the adjacent network can exploit this to disclose up to roughly 250 bytes of kernel memory, including kernel pointers. The vulnerability is identified as CWE-130 (Improper Handling of Length Parameter Inconsistency).

An unauthenticated attacker on the adjacent network can exploit this vulnerability to read sensitive kernel memory, including kernel pointers, by sending a single crafted ARP request. This memory disclosure could aid further attacks such as kernel address space layout randomization (KASLR) bypass or other kernel exploits. There is no indication of privilege escalation or denial of service from this vulnerability alone.

A fix is expected in the DragonFly BSD 6.6 stable release. Until then, users should monitor the official DragonFly BSD advisories for the release of this update. No other vendor advisory or patch information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.