Version in base suite: 10.1.0-11+deb13u3 Base version: dhcpcd_10.1.0-11+deb13u3 Target version: dhcpcd_10.1.0-11+deb13u4 Base file: /srv/ftp-master.debian.org/ftp/pool/main/d/dhcpcd/dhcpcd_10.1.0-11+deb13u3.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/d/dhcpcd/dhcpcd_10.1.0-11+deb13u4.dsc changelog | 8 + copyright | 2 patches/75289ca54211481d21b0c915db98dd733b30794f.patch | 71 +++++++++++++++++ patches/79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch | 2 patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch | 4 patches/series | 7 + 6 files changed, 89 insertions(+), 5 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmphdxizg9_/dhcpcd_10.1.0-11+deb13u3.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmphdxizg9_/dhcpcd_10.1.0-11+deb13u4.dsc: no acceptable signature found diff -Nru dhcpcd-10.1.0/debian/changelog dhcpcd-10.1.0/debian/changelog --- dhcpcd-10.1.0/debian/changelog 2026-06-26 15:23:21.000000000 +0000 +++ dhcpcd-10.1.0/debian/changelog 2026-07-14 11:36:11.000000000 +0000 @@ -1,3 +1,11 @@ +dhcpcd (1:10.1.0-11+deb13u4) trixie; urgency=medium + + * [patches] + + Cherry-pick upstream fix for CVE-2026-14258 (commit 75289ca). + = Refresh all patches. + + -- Martin-Éric Racine Tue, 14 Jul 2026 14:36:11 +0300 + dhcpcd (1:10.1.0-11+deb13u3) trixie; urgency=medium * [patches] (Closes: #1140767) diff -Nru dhcpcd-10.1.0/debian/copyright dhcpcd-10.1.0/debian/copyright --- dhcpcd-10.1.0/debian/copyright 2026-06-26 15:08:05.000000000 +0000 +++ dhcpcd-10.1.0/debian/copyright 2026-07-14 11:33:14.000000000 +0000 @@ -92,7 +92,7 @@ Files: debian/* Copyright: 2023, Andreas Beckmann - 2022-2025, Martin-Éric Racine + 2022-2026, Martin-Éric Racine 2018, Scott Leggett 2015, Daniel Echeverry 2014, Salvatore Bonaccorso diff -Nru dhcpcd-10.1.0/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch dhcpcd-10.1.0/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch --- dhcpcd-10.1.0/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch 1970-01-01 00:00:00.000000000 +0000 +++ dhcpcd-10.1.0/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch 2026-07-14 11:33:15.000000000 +0000 @@ -0,0 +1,71 @@ +From 75289ca54211481d21b0c915db98dd733b30794f Mon Sep 17 00:00:00 2001 +From: Roy Marples +Date: Sat, 7 Dec 2024 10:25:44 +0000 +Subject: [PATCH] IPv6: Discard NA packets with a zero length option + +As per RFC 4861 4.6. + +Fixes #415. +--- + src/ipv6nd.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +--- a/src/ipv6nd.c ++++ b/src/ipv6nd.c +@@ -974,6 +974,12 @@ + bool new_ia; + #endif + ++#define FREE_RAP(rap) \ ++ if (new_rap) \ ++ ipv6nd_removefreedrop_ra(rap, 0, 0); \ ++ else \ ++ ipv6nd_free_ra(rap); \ ++ + if (ifp == NULL || RS_STATE(ifp) == NULL) { + #ifdef DEBUG_RS + logdebugx("RA for unexpected interface from %s", sfrom); +@@ -1130,8 +1136,10 @@ + memcpy(&ndo, p, sizeof(ndo)); + olen = (size_t)ndo.nd_opt_len * 8; + if (olen == 0) { ++ /* RFC4681 4.6 says we MUST discard this ND packet. */ + logerrx("%s: zero length option", ifp->name); +- break; ++ FREE_RAP(rap); ++ return; + } + if (olen > len) { + logerrx("%s: option length exceeds message", +@@ -1155,10 +1163,7 @@ + else + logwarnx("%s: reject RA (option %d) from %s", + ifp->name, ndo.nd_opt_type, rap->sfrom); +- if (new_rap) +- ipv6nd_removefreedrop_ra(rap, 0, 0); +- else +- ipv6nd_free_ra(rap); ++ FREE_RAP(rap); + return; + } + +@@ -1409,10 +1414,7 @@ + { + logwarnx("%s: reject RA (no option %s) from %s", + ifp->name, dho->var, rap->sfrom); +- if (new_rap) +- ipv6nd_removefreedrop_ra(rap, 0, 0); +- else +- ipv6nd_free_ra(rap); ++ FREE_RAP(rap); + return; + } + } +@@ -1494,6 +1496,7 @@ + + /* Expire should be called last as the rap object could be destroyed */ + ipv6nd_expirera(ifp); ++#undef FREE_RAP + } + + bool diff -Nru dhcpcd-10.1.0/debian/patches/79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch dhcpcd-10.1.0/debian/patches/79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch --- dhcpcd-10.1.0/debian/patches/79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch 2026-06-26 15:13:59.000000000 +0000 +++ dhcpcd-10.1.0/debian/patches/79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch 2026-07-14 11:33:15.000000000 +0000 @@ -16,7 +16,7 @@ +++ b/src/dhcpcd.conf @@ -34,11 +34,6 @@ # Most distributions have NTP support. - option ntp_servers + #option ntp_servers -# Rapid commit support. -# Safe to enable by default because it requires the equivalent option set diff -Nru dhcpcd-10.1.0/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch dhcpcd-10.1.0/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch --- dhcpcd-10.1.0/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch 2026-06-26 15:13:58.000000000 +0000 +++ dhcpcd-10.1.0/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch 2026-07-14 11:33:15.000000000 +0000 @@ -15,5 +15,5 @@ -#option ntp_servers +option ntp_servers - # Rapid commit support. - # Safe to enable by default because it requires the equivalent option set + # A ServerID is required by RFC2131. + require dhcp_server_identifier diff -Nru dhcpcd-10.1.0/debian/patches/series dhcpcd-10.1.0/debian/patches/series --- dhcpcd-10.1.0/debian/patches/series 2026-06-26 15:13:25.000000000 +0000 +++ dhcpcd-10.1.0/debian/patches/series 2026-07-14 11:33:15.000000000 +0000 @@ -1,5 +1,4 @@ Debian_uncomment_hostname_in_dhcpcd_conf.patch -Debian_uncomment_ntp_servers_dhcpcd_conf.patch 25689325f81c7a61bd48f5727eaae1d6f16e1328.patch 2870767a79537b5d6918e7de80358b406fea0898.patch fdeb8c7945211d424c3a30912004eeb56e009865.patch @@ -7,9 +6,15 @@ 79c195b92f892c6f22fa07332c10fd9c2a8b679a.patch 6acf895a66b143c42308777e085c1511cdebe5e0.patch 5db90127b1c3128480a52559a9cdbd4949a0fed4.patch +#10.1.0-11+deb13u1 eac7152ec04f5a330f01ab9504514a03f873b35c.patch +#10.1.0-11+deb13u2 +Debian_uncomment_ntp_servers_dhcpcd_conf.patch +#10.1.0-11+deb13u3 117742d755b591764036dd4218f314f748a3d2b7.patch 2f00c7bfc408b6582d331932dfa47829c4819029.patch 5733d3c59a5651f64357ac11c98b4f39895c8d25.patch 708b4a56bae080a5b18c2e0c4c6fbe103131a2b0.patch 78ea09ed1633a583dbcde6e7bab9df4639ec8a34.patch +#10.1.0-11+deb13u4 +75289ca54211481d21b0c915db98dd733b30794f.patch