CVE-2026-53918 odhcpd DHCPv6 IA dangling first pointer use-after-free

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message first lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network...

OpenWRT odhcpd resource management error vulnerability

OpenWRT odhcpd versions prior to 25.12 contain a resource management error vulnerability. This vulnerability arises because the DHCPv6 IA handler retains a first lease pointer for each message; multiple IA options reuse the same Reconfigure authentication key. When adjacent network clients send...