ConnMan: Stack-based buffer overflow in DHCPv6 (CVE-2026-115863)

ConnMan versions up to and including 2.0 are vulnerable to a stack-based buffer overflow in the DHCPv6 implementation. The vulnerability resides in the get_domains function within gdhcp/client.c. Improper handling of the DOMAIN_LIST (option 24) in DHCPv6 Reply messages allows for memory corruption during DNS label parsing. The flaw is triggered when the client processes a crafted Reply message containing a DOMAIN_LIST option exceeding 1025 bytes, resulting in out-of-bounds reads and writes.

Impact

Successful exploitation allows an unauthenticated, on-link attacker to crash the connmand service. Because connmand typically operates with root privileges, this results in a denial-of-service condition for the affected system's network management functionality.

Recommendation

Identify systems running connmand versions 2.0 or earlier. Monitor vendor security channels for the release of a patched version of ConnMan and schedule upgrades accordingly. As this is an on-link network attack, segment vulnerable systems where possible until patches are applied.