Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation
CVE-2026-12969 is fixed in 4 products on 1 platform, first by dnsmasq 2.92-1ubuntu0.4, released June 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.
An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| dnsmasq · Debian 13.5 (trixie) | 2.91-1+deb13u2 | DEBIAN-CVE-2026-12969 | Jun 24, 2026 |
| dnsmasq · Debian 14 | 2.93-1 | DEBIAN-CVE-2026-12969 | Jun 24, 2026 |
| dnsmasq · Ubuntu 18.04.6 LTS (bionic) | 2.90-0ubuntu0.18.04.1+esm4 | dnsmasq 2.90-0ubuntu0.18.04.1+esm4 | Jul 18, 2026 |
| dnsmasq · Ubuntu 20.04 LTS (focal) | 2.90-0ubuntu0.20.04.1+esm3 | dnsmasq 2.90-0ubuntu0.20.04.1+esm3 | Jul 18, 2026 |
| dnsmasq · Ubuntu 22.04.1 LTS (jammy) | 2.90-0ubuntu0.22.04.4 | dnsmasq 2.90-0ubuntu0.22.04.4 | Jul 18, 2026 |
| dnsmasq · Ubuntu 24.04.5 LTS (noble) | 2.90-2ubuntu0.4 | dnsmasq 2.90-2ubuntu0.4 | Jul 18, 2026 |
| dnsmasq · Ubuntu 26.04.1 LTS (resolute) | 2.92-1ubuntu0.4 | dnsmasq 2.92-1ubuntu0.4 | Jun 23, 2026 |
| dnsmasq · sles 15.6 | 2.93-150400.16.17.1 | SUSE-SU-2026:3028-1 | Jul 15, 2026 |
| dnsmasq · sles 15.7 | 2.93-150400.16.17.1 | SUSE-SU-2026:3028-1 | Jul 15, 2026 |
| dnsmasq-base · Ubuntu 18.04.6 LTS (bionic) | 2.90-0ubuntu0.18.04.1+esm4 | dnsmasq-base 2.90-0ubuntu0.18.04.1+esm4 | Jul 18, 2026 |
| dnsmasq-base · Ubuntu 20.04 LTS (focal) | 2.90-0ubuntu0.20.04.1+esm3 | dnsmasq-base 2.90-0ubuntu0.20.04.1+esm3 | Jul 18, 2026 |
| dnsmasq-base · Ubuntu 22.04.1 LTS (jammy) | 2.90-0ubuntu0.22.04.4 | dnsmasq-base 2.90-0ubuntu0.22.04.4 | Jul 18, 2026 |
| dnsmasq-base · Ubuntu 24.04.5 LTS (noble) | 2.90-2ubuntu0.4 | dnsmasq-base 2.90-2ubuntu0.4 | Jul 18, 2026 |
| dnsmasq-base · Ubuntu 26.04.1 LTS (resolute) | 2.92-1ubuntu0.4 | dnsmasq-base 2.92-1ubuntu0.4 | Jun 23, 2026 |
| dnsmasq-base-lua · Ubuntu 18.04.6 LTS (bionic) | 2.90-0ubuntu0.18.04.1+esm4 | dnsmasq-base-lua 2.90-0ubuntu0.18.04.1+esm4 | Jul 18, 2026 |
| dnsmasq-base-lua · Ubuntu 20.04 LTS (focal) | 2.90-0ubuntu0.20.04.1+esm3 | dnsmasq-base-lua 2.90-0ubuntu0.20.04.1+esm3 | Jul 18, 2026 |
| dnsmasq-base-lua · Ubuntu 22.04.1 LTS (jammy) | 2.90-0ubuntu0.22.04.4 | dnsmasq-base-lua 2.90-0ubuntu0.22.04.4 | Jul 18, 2026 |
| dnsmasq-base-lua · Ubuntu 24.04.5 LTS (noble) | 2.90-2ubuntu0.4 | dnsmasq-base-lua 2.90-2ubuntu0.4 | Jul 18, 2026 |
| dnsmasq-base-lua · Ubuntu 26.04.1 LTS (resolute) | 2.92-1ubuntu0.4 | dnsmasq-base-lua 2.92-1ubuntu0.4 | Jun 23, 2026 |
| dnsmasq-utils · Ubuntu 18.04.6 LTS (bionic) | 2.90-0ubuntu0.18.04.1+esm4 | dnsmasq-utils 2.90-0ubuntu0.18.04.1+esm4 | Jul 18, 2026 |
| dnsmasq-utils · Ubuntu 20.04 LTS (focal) | 2.90-0ubuntu0.20.04.1+esm3 | dnsmasq-utils 2.90-0ubuntu0.20.04.1+esm3 | Jul 18, 2026 |
| dnsmasq-utils · Ubuntu 22.04.1 LTS (jammy) | 2.90-0ubuntu0.22.04.4 | dnsmasq-utils 2.90-0ubuntu0.22.04.4 | Jul 18, 2026 |
| dnsmasq-utils · Ubuntu 24.04.5 LTS (noble) | 2.90-2ubuntu0.4 | dnsmasq-utils 2.90-2ubuntu0.4 | Jul 18, 2026 |
| dnsmasq-utils · Ubuntu 26.04.1 LTS (resolute) | 2.92-1ubuntu0.4 | dnsmasq-utils 2.92-1ubuntu0.4 | Jun 23, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.