UBUNTU-CVE-2026-2291

Details

dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, which could result in DNS lookups to redirect to an attacker-controlled IP address, or to cause a DoS.

Affected Packages

dnsmasq

Ubuntu 22.04 LTS

Fixed in:

2.90-0ubuntu0.22.04.3

dnsmasq

Ubuntu 24.04 LTS

Fixed in:

2.90-2ubuntu0.3

dnsmasq

Ubuntu 25.10

Fixed in:

2.91-1ubuntu0.2

dnsmasq

Ubuntu 26.04 LTS

Fixed in:

2.92-1ubuntu0.2

dnsmasq

Ubuntu Pro 14.04 LTS

Fixed in:

2.68-1ubuntu0.2+esm5

dnsmasq

Ubuntu Pro 16.04 LTS

Fixed in:

2.90-0ubuntu0.16.04.1+esm3

dnsmasq

Ubuntu Pro 18.04 LTS

Fixed in:

2.90-0ubuntu0.18.04.1+esm3

dnsmasq

Ubuntu Pro 20.04 LTS

Fixed in:

2.90-0ubuntu0.20.04.1+esm2

References

REPORT

https://ubuntu.com/security/CVE-2026-2291

ADVISORY

https://ubuntu.com/security/notices/USN-8268-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2026-2291