UBUNTU-CVE-2026-4892

Details

A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code with root privileges via a crafted DHCPv6 packet.

Affected Packages

dnsmasq

Ubuntu 22.04 LTS

Fixed in:

2.90-0ubuntu0.22.04.3

dnsmasq

Ubuntu 24.04 LTS

Fixed in:

2.90-2ubuntu0.3

dnsmasq

Ubuntu 25.10

Fixed in:

2.91-1ubuntu0.2

dnsmasq

Ubuntu 26.04 LTS

Fixed in:

2.92-1ubuntu0.2

dnsmasq

Ubuntu Pro 14.04 LTS

Fixed in:

2.68-1ubuntu0.2+esm5

dnsmasq

Ubuntu Pro 16.04 LTS

Fixed in:

2.90-0ubuntu0.16.04.1+esm3

dnsmasq

Ubuntu Pro 18.04 LTS

Fixed in:

2.90-0ubuntu0.18.04.1+esm3

dnsmasq

Ubuntu Pro 20.04 LTS

Fixed in:

2.90-0ubuntu0.20.04.1+esm2

References

REPORT

https://ubuntu.com/security/CVE-2026-4892

ADVISORY

https://ubuntu.com/security/notices/USN-8268-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2026-4892