CVE-2026-124740— Busybox: use-after-free of requested_ipv6 in udhcpc6

Quick assessment

Affected

Red Hat Red Hat Enterprise Linux 6

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 BusyBox 的 udhcpc6 DHCPv6 客户端中发现了一个缺陷。本地网络中的恶意服务器可以通过发送一个缺少可用地址选项的伪造 DHCPv6 响应数据包，触发“释放后使用”（use-after-free）漏洞。该问题会导致客户端读取陈旧的堆内存，从而引发应用程序崩溃造成拒绝服务（DoS），或在后续发现请求中泄露先前分配的地址数据。

CVSS 4.3 · Medium Updated Nov 11, 2026

Possible ATT&CK Techniques 3 AI

T1499 · Endpoint Denial of Service T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Busybox: use-after-free of requested_ipv6 in udhcpc6

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by responding with a crafted Dynamic Host Configuration Protocol for IPv6 (DHCPv6) reply packet lacking usable address options. This issue causes the client to read stale heap memory, which can result in a Denial of Service (DoS) due to an application crash or disclose previously assigned network address data in subsequent discovery requests.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

释放后使用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Red Hat	Red Hat Enterprise Linux 6	-	`cpe:/o:redhat:rhel_els:6`
Red Hat	Red Hat Hardened Images	-	`cpe:/a:redhat:hummingbird:1`

II. Public POCs for CVE-2026-124740

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124740

请登录查看更多情报信息。

Other References for CVE-2026-124740 (2)

https://access.redhat.com/security/cve/CVE-2026-124740 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2571616 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-124740

Same Patch Batch · Red Hat · 2026-11-11 · 10 CVEs total

CVE-2026-124741	7.6 HIGH	Busybox: stack buffer overflow in udhcpc6 send_d6_renew() and send_d6_release()
CVE-2026-124739	7.5 HIGH	Busybox: httpd stack buffer overflow via an "i:" rule in a subdirectory httpd.conf
CVE-2026-124737	7.5 HIGH	Busybox: heap buffer overflow in the tftp client on fallback to the default block size
CVE-2026-116468	6.6 MEDIUM	Keycloak-services: keycloak-services: delegated admin escalates to realm-admin via group m
CVE-2026-124744	6.3 MEDIUM	Busybox: cpio hardlink target not sanitized under feature_path_traversal_protection
CVE-2026-124745	6.3 MEDIUM	Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extr
CVE-2026-124743	5.5 MEDIUM	Busybox: divide-by-zero and heap over-read in the volume_id hfs+ prober
CVE-2026-124742	5.5 MEDIUM	Busybox: divide-by-zero in the volume_id fat prober via a zero sectors_per_cluster value
CVE-2026-124738	5.3 MEDIUM	Busybox: httpd password rule bypass for pre-compressed .gz files via accept-encoding: gzip

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 6

Same vendor: Red Hat

Same weakness: CWE-416