Red Hat Fixes Five dnsmasq DNS and DHCP Flaws in Legacy Enterprise Linux Builds
Red Hat has published security advisory RHSA-2026:98116, an Important-rated update for the dnsmasq packages shipped with Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and the Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. The update resolves five separate CVEs in dnsmasq, the lightweight DNS forwarder and DHCP server bundled into many Red Hat server and gateway deployments. The affected products are Red Hat Enterprise Linux for x86_64 Extended Life Cycle Long Life 8.4 and Red Hat Enterprise Linux Server AUS 8.4, both on x86_64. The fixed package set is dnsmasq-2.79-15.el8_4.3, covering the base dnsmasq, dnsmasq-utils and associated debuginfo and debugsource RPMs. The same release also ships a bug fix and enhancement adding the 2024 DNSSEC trust anchor key, tracked internally as RHEL-272332.
Red Hat describes each flaw by its defect class rather than publishing a full exploitation walkthrough, so the mechanics below are limited to what the vendor has stated. CVE-2026-2291 is a heap buffer overflow in the dnsmasq cache triggered through NAME_ESCAPE expansion. CVE-2026-4890 is an infinite loop in the parsing of NSEC bitmaps, a DNSSEC record type, while CVE-2026-4891 is an rdlen underflow when handling RRSIG records that leads to a heap out-of-bounds read. On the DHCP side, CVE-2026-4892 is a buffer overflow in the helper process handling the DHCPv6 client identifier, and CVE-2026-4893 is a broken validation check on the EDNS Client Subnet source, allowing that validation to be bypassed. Four of the five therefore sit in code paths that process untrusted network input, either upstream DNS responses or client-supplied DHCPv6 data. Red Hat has not stated that any of the five has been weaponised, and no proof-of-concept code is referenced in the advisory.
The exposure here is shaped less by the individual bugs than by where dnsmasq tends to sit. It is commonly deployed on network edges and internal resolvers, meaning the vulnerable parsing code is reachable by whatever DNS or DHCPv6 traffic the host is willing to accept, and a resolver that loops forever or reads out of bounds takes name resolution for everything behind it with it. The ECS source validation bypass is the more subtle of the set, since weakened validation of client subnet data affects the integrity of what a resolver returns rather than its availability. Current exploitation signals are modest: FIRST EPSS places CVE-2026-4890 at an 8.8 percent probability of exploitation in the next 30 days and CVE-2026-4891 at 6.4 percent, with CVE-2026-4893 at 1.8 percent, CVE-2026-4892 at 0.8 percent and CVE-2026-2291 at 0.6 percent. None of the five appears in the verified exploitation evidence as confirmed in-the-wild activity. What raises the practical risk is the estate involved — RHEL 8.4 AUS and Extended Life Cycle systems are, by definition, long-lived production hosts kept on a frozen minor release precisely because change is expensive, which is also why vulnerable dnsmasq builds tend to linger on them far longer than on a current release.
Attack Surface
Server OS, Infrastructure
Tactics
Initial Access, Impact, Collection
Techniques
- T1190 – Exploit Public-Facing Application
- T1499 – Endpoint Denial of Service
- T1557 – Adversary-in-the-Middle
SuperPRO's Threat Countermeasures Procedures
- Update dnsmasq and dnsmasq-utils to 2.79-15.el8_4.3 on all Red Hat Enterprise Linux 8.4 AUS and Extended Life Cycle Long Life x86_64 hosts, per RHSA-2026:98116, and confirm with rpm -q dnsmasq that the installed release is el8_4.3 or later.
- Verify package integrity before deployment against the published SHA-256 values, for example b593324bd19df578fe28586cce5f6fc23b4579723a88be6bbfb74d189572ccdb for dnsmasq-2.79-15.el8_4.3.x86_64.rpm and 30afe391b3f64b58f05e3f071433f560764bccdf921b67471bf3a1f61c6c5c8c for the source RPM.
- Use the Red Hat Lightspeed patch analysis view linked from the errata to enumerate which subscribed systems are still reporting a pre-2.79-15.el8_4.3 dnsmasq build, rather than relying on manual inventory of long-life hosts.
- Restrict exposure of the dnsmasq listener by binding it to internal interfaces with the interface= or listen-address= directives in /etc/dnsmasq.conf, and block inbound UDP/TCP 53 and UDP 547 (DHCPv6 server) from untrusted networks at the host firewall until the package update is deployed.
- Review whether EDNS Client Subnet is enabled via the add-subnet option in /etc/dnsmasq.conf and disable it on resolvers that do not require it, since CVE-2026-4893 is a bypass of ECS source validation.
- After updating, confirm the new 2024 DNSSEC trust anchor shipped with this release is in place by checking the trust-anchor entries used by dnsmasq (RHEL-272332) and restart the service with systemctl restart dnsmasq so the patched binary and new anchor are both loaded.
- Monitor dnsmasq for availability symptoms consistent with CVE-2026-4890 and CVE-2026-4891 on unpatched hosts, specifically a dnsmasq process pinning a CPU core with no corresponding query throughput, or repeated segfault entries for dnsmasq in journalctl -u dnsmasq.
