CVE-2026-88833: BusyBox udhcpc DHCP Client DOS Vulnerability

CVE-2026-88833 Overview

CVE-2026-88833 is an integer underflow vulnerability [CWE-191] in the udhcpc DHCP client component of BusyBox. The client fails to re-validate packet length after replacing the validated length with an attacker-controlled value sourced from the IP header. Subtracting header sizes against this unvalidated length triggers an underflow, which is then passed to a memory copy operation with an oversized length.

An attacker on the same network segment can send a crafted DHCP packet to crash the client. The outcome is denial of service and loss of network connectivity on affected devices, which commonly include embedded systems, IoT devices, and container images that bundle BusyBox.

Critical Impact

An adjacent-network attacker can crash the udhcpc client with a single malformed DHCP packet, disrupting network connectivity on BusyBox-based systems.

Affected Products

• BusyBox udhcpc DHCP client (per Red Hat advisory)
• Embedded Linux distributions bundling vulnerable BusyBox builds
• IoT and container images using BusyBox as the base userland

Discovery Timeline

• 2026-10-13 - CVE-2026-88833 published to the National Vulnerability Database (NVD)
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-88833

Vulnerability Analysis

The flaw resides in the raw DHCP packet processing path of BusyBox udhcpc. After the client performs an initial size validation, it overwrites the validated length variable with the tot_len field read from the attacker-supplied IP header. The code then subtracts the IP and UDP header sizes from this value to derive the DHCP payload length, but it does not re-check that the attacker-controlled value is larger than those headers.

When the attacker sets a tot_len smaller than the combined header length, the subtraction wraps around on an unsigned integer. The resulting length is a very large positive number. The client subsequently uses this length as the size argument to a memory copy, triggering an out-of-bounds read that crashes the process.

Root Cause

The root cause is a missing lower-bound check on the IP header length field before arithmetic is performed, mapped to [CWE-191] Integer Underflow (Wrap or Wraparound). The validated packet length should remain authoritative, or the derived payload length should be checked against a minimum before use.

Attack Vector

Exploitation requires network adjacency, meaning the attacker must be on the same broadcast domain as the DHCP client. The attacker crafts a raw DHCP response or offer with a malformed tot_len IP header field and transmits it to the target. No authentication or user interaction is required. The impact is limited to availability, with no confidentiality or integrity consequences. The EPSS score reported for this CVE is 0.188%.

No verified public proof-of-concept code is available. See the Red Hat CVE-2026-88833 Advisory and Red Hat Bug #2531347 Details for technical details.

Detection Methods for CVE-2026-88833

Indicators of Compromise

• Repeated or unexpected crashes of the udhcpc process on BusyBox-based hosts
• Loss of DHCP lease renewal followed by sudden loss of IPv4 connectivity on affected devices
• Malformed DHCP packets on the local segment where the IP tot_len field is smaller than the sum of IP and UDP header lengths

Detection Strategies

• Inspect DHCP traffic at the switch or gateway for IP packets whose tot_len is less than 28 bytes, which is below the valid IP plus UDP header size
• Monitor process supervisors such as systemd, init, or BusyBox launchers for abnormal exit codes from udhcpc
• Correlate client-side DHCP timeouts with packet captures to identify crafted DHCP offers originating from unauthorized hosts

Monitoring Recommendations

• Enable DHCP snooping on managed switches to restrict DHCP server responses to trusted ports
• Forward host logs covering udhcpc restarts and link-state changes to a centralized logging platform for correlation
• Alert on repeated DHCP client restarts across multiple embedded or IoT devices within a short interval

How to Mitigate CVE-2026-88833

Immediate Actions Required

• Inventory systems and container images that ship BusyBox and identify those using udhcpc as the DHCP client
• Apply vendor patches as soon as fixed BusyBox builds are published by your distribution or device vendor
• Restrict Layer 2 access to the affected segments and enforce DHCP snooping to block rogue DHCP traffic

Patch Information

Track the Red Hat CVE-2026-88833 Advisory and Red Hat Bug #2531347 Details for the status of fixed packages. Rebuild embedded firmware and container images using the patched BusyBox release once available from upstream.

Workarounds

• Replace udhcpc with an alternative DHCP client such as dhclient or systemd-networkd on systems where the BusyBox build is not immediately patchable
• Configure static IP addressing on critical devices to eliminate reliance on DHCP until a fix is deployed
• Enforce DHCP snooping and port-security controls at the access layer to limit which hosts can send DHCP responses

# Example: enable DHCP snooping on a Cisco access switch
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 10
interface GigabitEthernet0/1
  ip dhcp snooping trust
end