Fix CVE-2026-14258

Resolves: RHEL-191220

dhcpcd-CVE-2026-14258.patch

@@ -0,0 +1,71 @@
+commit 75289ca54211481d21b0c915db98dd733b30794f
+Author: Roy Marples <roy@marples.name>
+Date:   Sat Dec 7 10:25:44 2024 +0000
+
+    IPv6: Discard NA packets with a zero length option
+    
+    As per RFC 4861 4.6.
+    
+    Fixes #415.
+
+diff --git a/src/ipv6nd.c b/src/ipv6nd.c
+index cc42c569..bfaf9274 100644
+--- a/src/ipv6nd.c
++++ b/src/ipv6nd.c
+@@ -974,6 +974,12 @@ ipv6nd_handlera(struct dhcpcd_ctx *ctx,
+ 	bool new_ia;
+ #endif
+ 
++#define FREE_RAP(rap)					\
++	if (new_rap)					\
++		ipv6nd_removefreedrop_ra(rap, 0, 0);	\
++	else						\
++		ipv6nd_free_ra(rap);			\
++
+ 	if (ifp == NULL || RS_STATE(ifp) == NULL) {
+ #ifdef DEBUG_RS
+ 		logdebugx("RA for unexpected interface from %s", sfrom);
+@@ -1130,8 +1136,10 @@ ipv6nd_handlera(struct dhcpcd_ctx *ctx,
+ 		memcpy(&ndo, p, sizeof(ndo));
+ 		olen = (size_t)ndo.nd_opt_len * 8;
+ 		if (olen == 0) {
++			/* RFC4681 4.6 says we MUST discard this ND packet. */
+ 			logerrx("%s: zero length option", ifp->name);
+-			break;
++			FREE_RAP(rap);
++			return;
+ 		}
+ 		if (olen > len) {
+ 			logerrx("%s: option length exceeds message",
+@@ -1155,10 +1163,7 @@ ipv6nd_handlera(struct dhcpcd_ctx *ctx,
+ 			else
+ 				logwarnx("%s: reject RA (option %d) from %s",
+ 				    ifp->name, ndo.nd_opt_type, rap->sfrom);
+-			if (new_rap)
+-				ipv6nd_removefreedrop_ra(rap, 0, 0);
+-			else
+-				ipv6nd_free_ra(rap);
++			FREE_RAP(rap);
+ 			return;
+ 		}
+ 
+@@ -1409,10 +1414,7 @@ ipv6nd_handlera(struct dhcpcd_ctx *ctx,
+ 		{
+ 			logwarnx("%s: reject RA (no option %s) from %s",
+ 			    ifp->name, dho->var, rap->sfrom);
+-			if (new_rap)
+-				ipv6nd_removefreedrop_ra(rap, 0, 0);
+-			else
+-				ipv6nd_free_ra(rap);
++			FREE_RAP(rap);
+ 			return;
+ 		}
+ 	}
+@@ -1494,6 +1496,7 @@ nodhcp6:
+ 
+ 	/* Expire should be called last as the rap object could be destroyed */
+ 	ipv6nd_expirera(ifp);
++#undef FREE_RAP
+ }
+ 
+ bool

dhcpcd.spec

@@ -15,7 +15,11 @@ Source3: %{name}.service
 Source4: %{name}@.service
 Source5: systemd-sysusers.conf
 Source6: systemd-tmpfiles.conf
+
 Patch1: dhcpcd-RHEL-72083.patch
+# https://redhat.atlassian.net/browse/RHEL-191220
+# https://github.com/NetworkConfiguration/dhcpcd/commit/75289ca
+Patch2: dhcpcd-CVE-2026-14258.patch
 
 BuildRequires: gcc
 BuildRequires: systemd-rpm-macros