CVE-2026-53918 openwrt CVE debrief

Who should care

Defenders responsible for OpenWrt deployments, especially those exposed to adjacent-network clients, should assess exposure and prioritize patching or mitigating this vulnerability to prevent potential denial-of-service attacks and key confusion.

Why it matters

This vulnerability can lead to denial-of-service attacks and key confusion in OpenWrt deployments, especially those exposed to adjacent-network clients. Defenders should prioritize patching or mitigating this vulnerability.

• Unauthenticated adjacent-network denial of service
• DHCPv6 Reconfigure/ForceRenew key confusion
• Potential disruption of network services
• Need for verification of affected versions and remediation

Technical summary

The odhcpd DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where OpenWrt is used, to prevent potential denial-of-service attacks and key confusion.

Recommended defensive actions

• Apply the patch in version 25.12 or later
• Restrict access to the odhcpd service to trusted networks
• Monitor for suspicious DHCPv6 traffic
• Verify affected OpenWrt deployments and prioritize patching
• Review compensating controls for exposed systems
• Check relevant monitoring and detection logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability was confirmed through AddressSanitizer (ASan) and native tracing, which showed that the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.