CVE-2026-12969: dnsmasq Out-of-Bounds Read Vulnerability

CVE-2026-12969 Overview

CVE-2026-12969 is an out-of-bounds read vulnerability in dnsmasq's find_soa() function located in src/rfc1035.c. The flaw occurs while parsing the NS section of DNS responses. The extract_name() function is invoked with extrabytes=0, which fails to confirm that 10 additional bytes remain available for fixed-length DNS record fields. A remote attacker who controls a DNS zone can trigger the read by serving a crafted NXDOMAIN response. The condition results in a 10-byte heap out-of-bounds read that may expose stale data from prior transactions handled by the dnsmasq process.

Critical Impact
Remote attackers controlling an authoritative DNS zone can disclose up to 10 bytes of adjacent heap memory per crafted NXDOMAIN response, potentially leaking residual data from previous DNS transactions.

Affected Products

dnsmasq (component: src/rfc1035.c, function find_soa())
Linux distributions packaging affected dnsmasq versions (see Red Hat advisory)
Embedded devices and routers bundling vulnerable dnsmasq builds

Discovery Timeline

2026-06-23 - CVE-2026-12969 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in the NVD database

Technical Details for CVE-2026-12969

Vulnerability Analysis

The defect is classified as an out-of-bounds read [CWE-125]. dnsmasq parses DNS response messages to extract resource record (RR) data. While processing the NS section in find_soa(), the parser calls extract_name() without reserving additional space for the fixed-length DNS RR header fields that follow the compressed name. These fields include the 2-byte TYPE, 2-byte CLASS, 4-byte TTL, and 2-byte RDLENGTH, totaling 10 bytes. Because the extrabytes argument is set to 0, the boundary check does not account for these trailing fields. A response whose name extends to the end of the message buffer causes the subsequent fixed-field read to access memory beyond the allocated DNS message buffer.

Root Cause

The root cause is missing length validation in the call site of extract_name() inside find_soa(). The function should pass extrabytes=10 to guarantee that the parser has space to read the RR header after the domain name. Passing 0 allows the parser to proceed even when only the name fits in the buffer, leading to a heap read of up to 10 bytes past the end of the DNS reply data.

Attack Vector

Exploitation requires the victim's dnsmasq instance to send a recursive query that reaches an attacker-controlled authoritative name server. The attacker responds with a malformed NXDOMAIN message in which the NS section record is crafted so the name terminates flush against the message boundary. When find_soa() parses the response, the out-of-bounds read occurs in the heap region adjacent to the DNS buffer. The disclosed bytes may contain residual data from prior queries, internal state, or other heap allocations. No authentication or user interaction is required, and the attack can be launched over the network.

No verified public proof-of-concept code is available. Technical analysis is documented in the Red Hat CVE-2026-12969 Advisory and the Red Hat Bug Report #2491663.

Detection Methods for CVE-2026-12969

Indicators of Compromise

DNS responses from external authoritative servers containing NS records whose name field extends to the end of the UDP or TCP DNS payload with no room for the trailing RR header.
Unexpected NXDOMAIN responses for queries forwarded by dnsmasq, particularly from rarely contacted authoritative zones.
dnsmasq process crashes or anomalous memory access patterns observed in host telemetry following recursive queries to attacker-controlled domains.

Detection Strategies

Inspect DNS traffic on port 53 (UDP and TCP) for malformed response messages where the RR section truncates after a compressed name without the required 10-byte fixed fields.
Use IDS signatures or DNS-aware parsers (Zeek, Suricata) to flag NXDOMAIN responses with truncated NS records.
Audit dnsmasq forwarders for outbound queries to unfamiliar authoritative zones and correlate with recent host activity.

Monitoring Recommendations

Forward dnsmasq query and reply logs to a centralized analytics platform and alert on parser errors or repeated NXDOMAIN responses from the same upstream server.
Monitor host telemetry for dnsmasq process crashes, memory faults, or unexpected restarts.
Track outbound recursive resolution toward newly registered or low-reputation domains.

How to Mitigate CVE-2026-12969

Immediate Actions Required

Apply vendor updates for dnsmasq as soon as distribution patches become available; track the Red Hat CVE-2026-12969 Advisory for fix status.
Restrict dnsmasq recursion to trusted clients and limit which upstream resolvers the service forwards to.
Inventory all systems running dnsmasq, including routers, IoT gateways, and container images that may bundle the library.

Patch Information

A distribution-level fix is being tracked through Red Hat Bugzilla entry #2491663. Operators should monitor their Linux distribution security feeds and the dnsmasq upstream project for a patched release that adds the missing length validation in find_soa() by passing the correct extrabytes value to extract_name().

Workarounds

Configure dnsmasq with explicit upstream resolvers using the server= directive and avoid forwarding arbitrary external queries directly to the Internet.
Use --bogus-nxdomain and DNSSEC validation where supported to reduce exposure to crafted authoritative responses.
Where dnsmasq is not required, disable the service and rely on a hardened resolver such as unbound or systemd-resolved.

bash

# Example dnsmasq.conf hardening
# Restrict listening interface
interface=lo
bind-interfaces

# Define trusted upstream resolvers only
no-resolv
server=1.1.1.1
server=9.9.9.9

# Enable DNSSEC validation
conf-file=/usr/share/dnsmasq/trust-anchors.conf
dnssec
dnssec-check-unsigned