CVE-2026-85234: tftp-hpa Daemon Denial of Service Vulnerability

CVE-2026-85234 Overview

A flaw exists in tftp-hpa, the widely deployed Trivial File Transfer Protocol (TFTP) server maintained in the Linux kernel source tree. The in.tftpd daemon's remap engine improperly handles inverse remap rules that abort with a non-empty custom error message. Under these conditions, the engine passes invalid match offsets to the genmatchstring() function, leading to out-of-bounds read and write operations [CWE-125]. A remote, unauthenticated attacker can trigger the flaw by sending a specially crafted TFTP request, causing the daemon to crash.

Critical Impact
Remote unauthenticated attackers can crash the in.tftpd daemon over the network, producing a denial-of-service condition against services that depend on TFTP, such as PXE boot and network device provisioning.

Affected Products

tftp-hpa package (in.tftpd server component)
Red Hat Enterprise Linux distributions shipping tftp-hpa (see Red Hat advisory)
Downstream Linux distributions repackaging the upstream tftp-hpa source

Discovery Timeline

2026-09-15 - CVE-2026-85234 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-85234

Vulnerability Analysis

The tftp-hpa server supports a remap engine that rewrites incoming filenames using regular-expression rules loaded from a mapping file. Rules can be marked as inverse (matching the negation of a pattern) and can be configured to abort a request with a custom error message returned to the client.

When an inverse remap rule is combined with a non-empty custom error message, the engine calculates match offsets that do not correspond to valid positions within the input buffer. Those offsets are passed directly to genmatchstring(), which constructs the response string by copying bytes from the offsets. The function reads and writes memory outside the intended buffer boundaries, corrupting adjacent memory and crashing the daemon.

Because in.tftpd typically runs as a persistent service or is spawned by xinetd/systemd for each request, repeated exploitation reliably suppresses the service. The vulnerability affects availability only; there is no impact on confidentiality or integrity.

Root Cause

The root cause is missing bounds validation on match offsets produced by the inverse remap code path before they are consumed by genmatchstring(). The upstream fix in commit 4b493532f5ce052a1c124acd0661233ec7918327 corrects the offset calculation and adds sanity checks so that invalid offsets are rejected instead of dereferenced.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted TFTP read or write request whose filename triggers an inverse remap rule configured with a custom error abort. The daemon processes the malformed offsets in genmatchstring() and crashes. Exploitation depends on the target server using a remap configuration that includes both inverse rules and custom error strings; default installations without such rules are not affected. See the Red Hat CVE-2026-85234 Advisory and the Kernel Git Commit tftp-hpa for the technical fix details.

Detection Methods for CVE-2026-85234

Indicators of Compromise

Unexpected termination of the in.tftpd process with segmentation fault entries in /var/log/messages or journalctl -u tftp.
Core dumps generated from in.tftpd following inbound TFTP traffic from untrusted sources.
Repeated TFTP request bursts from a single source IP followed by service restarts under systemd or xinetd.

Detection Strategies

Monitor host logs for in.tftpd crash signatures and correlate with UDP/69 traffic to identify targeted probing.
Deploy network monitoring rules that flag high volumes of malformed TFTP requests toward internal PXE and provisioning servers.
Review tftpd remap configuration files for rules that combine inverse matching with custom error messages, since these are the exploitable code paths.

Monitoring Recommendations

Alert on systemd service restart loops for tftp.socket or tftp.service units on affected hosts.
Ingest TFTP server logs and syslog into a centralized SIEM to correlate crashes with source IPs and packet contents.
Track process availability metrics for TFTP daemons in provisioning and boot infrastructure to detect degraded availability early.

How to Mitigate CVE-2026-85234

Immediate Actions Required

Apply the vendor-provided tftp-hpa update as soon as it is available from your Linux distribution.
Restrict inbound access to UDP port 69 using host firewalls or network access control lists so that only authorized clients can reach the daemon.
Audit /etc/tftpd.remap (or the configured remap file) and temporarily remove inverse rules that carry custom error abort messages.

Patch Information

The upstream fix is available in the tftp-hpa repository as commit 4b493532f5ce052a1c124acd0661233ec7918327. Red Hat tracks distribution-specific package updates in the Red Hat CVE-2026-85234 Advisory and the associated Red Hat Bug Report #2460997. Administrators should update to the patched package version provided by their vendor and restart the tftp service.

Workarounds

Disable the tftp-hpa service on hosts where it is not required by running systemctl disable --now tftp.socket tftp.service.
Remove or comment out remap rules that combine inverse matches with custom error strings until the patched package is deployed.
Place TFTP servers on isolated provisioning VLANs and enforce source-IP allowlists at the network boundary to reduce exposure.

bash

# Configuration example: restrict TFTP to a trusted provisioning subnet
# /etc/hosts.allow
in.tftpd: 10.10.20.0/24

# /etc/hosts.deny
in.tftpd: ALL

# Firewalld example limiting UDP/69 to the provisioning zone
firewall-cmd --permanent --zone=provisioning --add-port=69/udp
firewall-cmd --permanent --zone=public --remove-service=tftp
firewall-cmd --reload