CVE-2026-4892 dnsmasq DHCPv6 CLID overflow leading to crash

Tim Peck@timpeck

•updated May 12, 2026•11•1•855

This rule detects potential exploitation of CVE-2026-4892 by correlating inbound DHCPv6 traffic (UDP/547) with a dnsmasq process crash (SIGSEGV/SIGABRT exit codes 132, 134, 135, 139) on the same host within a 60-second window. This vulnerability involves sending crafted DHCPv6 messages with oversized Client Identifier options to a dnsmasq server configured with --dhcp-script, leading to a denial of service.