CVE-2026-110912 DragonFlyBSD CVE debrief

Who should care

Defenders responsible for systems using DragonFly BSD, especially those with network exposure, should assess their exposure and prioritize patching. This includes verifying the version of DragonFly BSD being used and applying patches as soon as possible. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need

Why it matters

CVE-2026-110912 is a high-severity vulnerability in DragonFly BSD that allows an unauthenticated attacker to disclose kernel memory. Defenders should prioritize verifying exposure and applying patches, especially for systems with network exposure.

• Potential disclosure of sensitive kernel memory contents
• Possible exposure of kernel pointers
• Verification of system patch levels and network exposure
• Prioritization of patching for DragonFly BSD systems

Technical summary

The ARP input handlers arpintr() and in_arpinput() in DragonFly BSD do not validate hardware address length and protocol address length fields of incoming ARP packets. This allows an attacker to disclose kernel memory using crafted ARP requests, potentially leading to the exposure of sensitive kernel memory contents and kernel pointers. The vulnerability is particularly concerning because it can be exploited using a single crafted ARP request, and an unauthenticated attacker on the adjacent network can exploit it. The

Defensive priority

Defenders should prioritize verifying exposure and applying patches as soon as possible, especially for systems using DragonFly BSD versions before 6.6 stable.

Recommended defensive actions

• Verify exposure by checking DragonFly BSD versions and applying patches as soon as possible
• Implement network monitoring to detect suspicious ARP requests
• Restrict network access to sensitive systems and services
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source code changes. The DragonFly BSD project has also provided information on the vulnerability and its fix. However, the exact scope of affected systems and the potential impact on organizations are not explicitly stated. Defenders should verify the exposure of their systems and apply patches as soon as possible. The CVE record and NVD entry also provide links to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.