dnsmasq versions prior to 2.92rel2 contain six critical vulnerabilities enabling DNS…
dnsmasq versions prior to 2.92rel2 contain six critical vulnerabilities enabling DNS cache poisoning, DoS, information disclosure, and local root privilege escalation.
dnsmasq, an open-source DNS/DHCP service widely deployed in small-to-medium networks and home routers, is affected by six memory safety and input validation vulnerabilities. The most severe flaw (CVE-2026-4892) allows local attackers to achieve arbitrary code execution with root privileges via crafted DHCPv6 packets. CVE-2026-2291 enables heap buffer overflows that permit DNS cache poisoning, potentially redirecting users to attacker-controlled infrastructure. Additional vulnerabilities include an infinite-loop DoS in DNSSEC validation (CVE-2026-4890), heap-based out-of-bounds reads leaking memory (CVE-2026-4891), source-check bypass via RFC 7871 client-subnet abuse (CVE-2026-4893), and crash-inducing buffer overflows in extract_addresses() (CVE-2026-5172).
The vulnerabilities collectively enable remote denial-of-service attacks, cache manipulation for traffic redirection, information disclosure, and local privilege escalation. Given dnsmasq's ubiquitous deployment in embedded devices, routers, and network appliances, the attack surface is substantial. Exploitation requires network-adjacent positioning for most attack vectors, though the DHCPv6 flaw requires local access. The dnsmasq project has released version 2.92rel2 addressing all vulnerabilities, with vendor-specific patches being distributed by SUSE, Pi-hole, NixOS, and others.
Organisations using dnsmasq in production environments should prioritise immediate patching, particularly for internet-facing or multi-tenant deployments. The cache poisoning and privilege escalation vectors present the highest risk, as they enable persistent compromise and lateral movement. Environments unable to patch immediately should consider disabling DNSSEC validation and DHCPv6 if not operationally required, and restricting network access to dnsmasq services.
Mentioned in this report
Detection guidance
Child Process Spawned by dnsmasq Process (Possible Exploitation)
Detects an unexpected child process (shell/interpreter) spawned from dnsmasq, consistent with exploitation of memory-corruption vulnerabilities (e.g., CVE-2026-4892 DHCPv6 RCE) leading to arbitrary code execution as root. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by dnsmasq
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith: /dnsmasq
Image|endswith:
- /sh
- /bash
- /dash
- /python3
- /perl
- /nc
- /curl
- /wget
condition: selection
falsepositives:
- Custom dnsmasq dhcp-script or lease hooks legitimately configured to call helper
scripts
- Administrative wrapper scripts that invoke dnsmasq via a shell and are misattributed
as children
level: high
tags:
- attack.t1068
- attack.privilege_escalation
id: cc2978f0-5b9c-5e67-9121-3485722ad912
status: experimental
author: Vorant
dnsmasq Process Crash and Immediate Respawn (Potential DoS Exploitation)
Detects dnsmasq being restarted by its service manager shortly after an abnormal termination, which can indicate exploitation of a crash-inducing vulnerability such as the DNSSEC infinite-loop DoS (CVE-2026-4890) or extract_addresses() buffer overflow (CVE-2026-5172). Repeated occurrences within a short window (e.g., multiple restarts per minute) should be treated as higher confidence and is not encoded in this rule's condition. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: dnsmasq Restarted by Service Manager After Termination
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /dnsmasq
ParentImage|endswith: /systemd
filter_normal_boot:
CommandLine|contains: --test
condition: selection and not filter_normal_boot
falsepositives:
- Routine service manager restarts during system boot or planned maintenance
- Configuration reloads triggered by administrators (systemctl restart dnsmasq)
level: low
tags:
- attack.t1499.004
- attack.impact
id: 2ba799f8-520e-5eb4-b8d0-c32d8c94f29b
status: experimental
author: Vorant
Anomalous High-Volume DHCPv6 Traffic to dnsmasq Service
Detects unusually large or numerous DHCPv6 packets directed at a dnsmasq-serviced host/port, which may indicate crafted-packet exploitation attempts targeting DHCPv6 parsing (CVE-2026-4892) or DNS cache poisoning setup via source-check bypass (CVE-2026-4893). Threshold-based volumetric correlation should be implemented downstream in the SIEM, not in this rule's condition. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious DHCPv6 Traffic Toward dnsmasq Service
logsource:
category: network_connection
product: linux
detection:
selection:
DestinationPort: 547
Protocol: udp
filter_local:
SourceIp|startswith:
- '10.'
- 192.168.
- 172.16.
condition: selection and not filter_local
falsepositives:
- Legitimate DHCPv6 lease renewals from many client devices on large networks
- Network scanning tools used for authorized asset discovery
level: medium
tags:
- attack.t1557.001
- attack.credential_access
id: 1457c338-78ed-5b55-b849-3cfce0fd2df8
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/471747
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free