CVE-2026-53918: odhcpd DHCPv6 IA dangling first pointer use-after-free

Vulnerability summary

CVE-2026-53918 is a high (CVSS 8.8) Use After Free vulnerability in openwrt odhcpd.

Timeline

1. 23-10-2026
   PublishedVulnerability first disclosed.

Description

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.

• CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
• CWE-672Operation on a Resource after Expiration or ReleaseThe product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
• CWE-825Expired Pointer DereferenceThe product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.