dnsmasq TFTP cache reuse allows malicious PXE boot
CVE-2026-93006 Published on October 29, 2026

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content
A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

NVD

Vulnerability Analysis

Attack Vector:
ADJACENT_NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Timeline

Reported to Red Hat.

Made public. 44 days later.

Weakness Type

Operation on a Resource after Expiration or Release

The software uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.


Products Associated with CVE-2026-93006

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Ceph Storage
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Openshift
 
Red Hat Openstack
 

Affected Versions

Red Hat Ceph Storage 9: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 6: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat OpenStack Platform 13 (Queens): Red Hat OpenStack Platform 18.0: