CVE-2026-18313: rpcapd Memory Leak Vulnerability

CVE-2026-18313 Overview

CVE-2026-18313 is a memory leak vulnerability [CWE-401] in rpcapd, the Remote Packet Capture Daemon shipped with libpcap. The daemon can allocate up to 65,536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from a client. The allocated memory is never freed, resulting in memory leakage even during normal use. An authenticated malicious client can accelerate the leak substantially by sending crafted messages repeatedly, degrading availability of the host running the daemon.

Critical Impact

Authenticated network attackers can exhaust server memory by repeatedly sending filter or capture-start requests to rpcapd, causing service degradation or denial of service.

Affected Products

• libpcap rpcapd (Remote Packet Capture Daemon) — versions prior to the fix commit f9775af1a0ec76db60c7213241e6b48f1be10ac7
• Deployments enabling remote capture via the tcpdump-group libpcap distribution
• Downstream packages bundling vulnerable rpcapd binaries

Discovery Timeline

• 2026-09-05 - CVE-2026-18313 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-18313

Vulnerability Analysis

The defect resides in the rpcapd message-handling path for BPF filter installation and capture initialization. When the daemon processes an RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ, it allocates a buffer sized according to the client-supplied filter length, up to 65,536 bytes. On error paths, the daemon returned directly without releasing the allocated buffer, and even on successful paths the memory management left allocations unfreed.

Because the leak occurs per-message, each client interaction contributes to a monotonically growing resident set size on the server. Over sustained sessions the daemon consumes progressively more system memory, which can trigger process termination by the OOM killer or cause host-wide performance issues.

Root Cause

The root cause is missing deallocation of heap buffers holding BPF filter instructions during both error and success paths in the rpcap protocol handlers. The upstream patch consolidates the error-return branches into a common free_and_return_status label so that allocated instruction buffers are freed before the function returns.

Attack Vector

Exploitation requires network access to the rpcapd service and low-privilege authentication. An attacker with valid credentials repeatedly issues RPCAP_MSG_UPDATEFILTER_REQ messages containing maximum-size filter programs. Each request forces the daemon to allocate up to 64 KB that is never released, providing a linear amplification vector for memory exhaustion.

// Excerpt from upstream fix in rpcapd/daemon.c
// Source: https://github.com/the-tcpdump-group/libpcap/commit/f9775af1a0ec76db60c7213241e6b48f1be10ac7
	{
		status = rpcapd_recv(sockctrl, ctrl_ssl, (char *) &insn,
		    sizeof(struct rpcap_filterbpf_insn), plenp, errmsgbuf);
-		if (status == -1)
-		{
-			return -1;
-		}
-		if (status == -2)
-		{
-			return -2;
-		}
+		if (status == -1 || status == -2)
+			goto free_and_return_status;

		bf_insn->code = ntohs(insn.code);
		bf_insn->jf = insn.jf;

The patch replaces bare return statements with a goto to a cleanup label that frees the allocated BPF instruction buffer before returning. See the GitHub commit for libpcap for the complete change.

Detection Methods for CVE-2026-18313

Indicators of Compromise

• Sustained growth in resident memory of the rpcapd process without corresponding capture workload
• High-frequency RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ traffic from a single authenticated client
• Out-of-memory events or kernel OOM-killer terminations targeting rpcapd
• Repeated authentication events from the same client followed by short-lived capture sessions

Detection Strategies

• Monitor per-process memory metrics for rpcapd and alert on abnormal growth rates over time
• Inspect rpcap protocol traffic (default TCP port 2002) for repetitive filter-update messages from single sources
• Correlate authenticated client sessions with server memory pressure events

Monitoring Recommendations

• Enable verbose logging in rpcapd to record client identifiers, session durations, and message counts
• Track host-level metrics such as RSS, VSZ, and OOM events for the daemon process
• Establish a baseline for legitimate remote-capture usage and flag deviations

How to Mitigate CVE-2026-18313

Immediate Actions Required

• Update libpcap to a release that includes commit f9775af1a0ec76db60c7213241e6b48f1be10ac7 or later
• Restrict network exposure of rpcapd to trusted management networks only
• Enforce strong authentication on rpcapd and audit accounts permitted to initiate remote captures
• Restart the rpcapd service on a schedule to reclaim leaked memory until patching completes

Patch Information

The upstream fix is available in the tcpdump-group libpcap repository. Refer to the GitHub commit for libpcap, which corrects the memory management in the rpcap filter and capture-start handlers. Distribution maintainers should rebuild libpcap packages that ship rpcapd and issue updated binaries to downstream consumers.

Workarounds

• Disable rpcapd entirely on hosts that do not require remote packet capture
• Firewall the rpcap listening port and permit only known administrator IP ranges
• Apply resource limits (ulimit, cgroups memory limits, or systemdMemoryMax=) to cap the daemon's memory usage
• Schedule periodic restarts of the service to reset accumulated leaked memory

# Example systemd hardening for rpcapd
[Service]
MemoryMax=256M
Restart=on-failure
RestartSec=30s

# Restrict access at the network layer
iptables -A INPUT -p tcp --dport 2002 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2002 -j DROP