FreeRTOS Plus TCP CVE-2026-7424: Integer Underflow in DHCPv6 Parser Enables Single Packet Denial of Service — Quick Look and Patch Analysis

Introduction

A single malformed DHCPv6 packet from an adjacent network device can permanently freeze the IP task on any FreeRTOS-based system running FreeRTOS-Plus-TCP with DHCPv6 enabled. Recovery takes a physical hardware reset. CVE-2026-7424 is an integer underflow in the DHCPv6 sub-option parser. The same flaw corrupts IPv6 address assignment and DNS configuration, and it carries a CVSS 3.1 score of 8.1 (High).

FreeRTOS is a market-leading real-time operating system for microcontrollers and small microprocessors. It supports over 40 processor architectures and is distributed freely under the MIT license. FreeRTOS-Plus-TCP is its companion open-source TCP/IP stack, widely deployed in IoT devices, industrial controllers, and embedded systems across virtually every vertical. AWS maintains the project and its Long Term Support libraries, so this vulnerability is relevant to a broad swath of the embedded ecosystem.

Technical Information

Root Cause: Unsigned Integer Underflow in prvDHCPv6_subOption()

The vulnerability is in the prvDHCPv6_subOption() function in source/FreeRTOS_DHCPv6.c. The function uses a switch statement to process known DHCPv6 sub-option types. Its default case handles unknown sub-option types by skipping their payload bytes, so the parser can move on to the next option.

The vulnerable code calculated the number of bytes to skip as uxLength2 - uxUsed. The two variables mean entirely different things:

• uxLength2 is the payload length of the current sub-option being processed.
• uxUsed is a cumulative counter of bytes consumed from the parent option.

Subtracting a cumulative parent counter from a single sub-option's length is incorrect. Both variables are unsigned (size_t), so when uxUsed exceeds uxLength2 (which it will in any message containing more than one sub-option), the subtraction wraps around to an extremely large positive value. The code then passes that wrapped value to xBitConfig_read_uc(), which tries to advance the parser index by that many bytes and corrupts the parser state entirely.

Attack Flow

The attack is straightforward and needs little sophistication:

1. The attacker must be on the same local network segment as the target device, which matches the CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The attack needs no authentication, no privileges, and no user interaction.

2. The attacker builds a single DHCPv6 response packet with at least one unknown sub-option type inside a parent option. The sub-option's declared payload length (uxLength2) must be smaller than the running count of bytes already consumed from the parent option (uxUsed). That happens naturally when the unknown sub-option comes after other sub-options the parser has already read.

3. When the target device's DHCPv6 client processes the packet, the default case in prvDHCPv6_subOption() runs the skip calculation. The unsigned subtraction wraps, and xBitConfig_read_uc() receives a massive byte count.

4. With its parser index corrupted, the device misreads the later fields in the DHCPv6 message and corrupts its IPv6 address assignment, DNS configuration, and lease times. The IP task freezes permanently, and recovery requires a hardware reset.

Because the attack takes only a single packet and no interaction from the target, any compromised or malicious device on the same Layer 2 segment can trigger it.

Impact Profile

The CVSS 3.1 assessment rates integrity impact as high (corrupted IPv6 and DNS settings) and availability impact as high (permanent task freeze). Confidentiality is unaffected. The scope is unchanged, which means the impact is confined to the vulnerable component itself. In practice, though, a frozen IP task leaves the entire device unable to do any networking.

Patch Information

FreeRTOS-Plus-TCP V4.4.1 and V4.2.6 fully patch the vulnerability, with identical fixes on both release branches. Aniruddha Kanhere of Amazon wrote the patches, which landed on April 29, 2026, in commits ca65d44 (V4.4.x line) and 0015547 (V4.2.x line). The change is surgical. It touches only source/FreeRTOS_DHCPv6.c, with 3 additions and 2 deletions.

This is the complete diff:

             default:
-                ( void ) xBitConfig_read_uc( pxMessage, NULL, uxLength2 - uxUsed );
+                ( void ) xBitConfig_read_uc( pxMessage, NULL, uxLength2 );
                 FreeRTOS_printf( ( "prvDHCPv6Analyse: skipped unknown option %u\n", usOption2 ) );
                 break;
         }

-        if( xReturn != pdTRUE )
+        if( ( xReturn != pdTRUE ) || ( pxMessage->xHasError != pdFALSE ) )
         {
+            xReturn = pdFALSE;
             FreeRTOS_printf( ( "prvDHCPv6_subOption: One of sub-options %d returns error\n", usOption2 ) );
             break;
         }

The diff makes three changes that work together.

Change 1: Eliminate the underflow. The skip call now advances by uxLength2 bytes (the sub-option's own payload length) instead of uxLength2 - uxUsed. This is the core fix. The parser now skips exactly the bytes that belong to the current unknown sub-option, however much data it has already consumed from the parent option.

Change 2: Guard on xHasError. The loop exit condition used to check only xReturn != pdTRUE. It now also checks pxMessage->xHasError != pdFALSE, as a defense-in-depth measure. An underlying xBitConfig_read_uc call that reads past the buffer sets xHasError on the message struct, even when no sub-option handler explicitly returns failure. Before this change, the loop silently ignored that flag and kept parsing with corrupted state.

Change 3: Propagate failure. When the new combined condition triggers, the code now explicitly sets xReturn = pdFALSE before it breaks out of the loop. The caller therefore receives the error status and does not use corrupted parser results for IPv6 address or DNS configuration.

The AWS security bulletin (2026-022-AWS) and the GitHub Security Advisory (GHSA-wrhm-c99p-2p8g) both confirm V4.4.1 and V4.2.6 as the fixed versions.

Workarounds for Environments That Cannot Patch Immediately

If you cannot upgrade right away, two interim mitigations are available:

Any forked or derivative code must also be patched with these fixes.

Affected Systems and Versions

The vulnerability affects two main version branches of FreeRTOS-Plus-TCP. The flaw is present whenever DHCPv6 is enabled (ipconfigUSE_DHCPv6 set to 1).

Devices running any affected version with DHCPv6 enabled and reachable from an adjacent network segment are vulnerable.

References

• NVD: CVE-2026-7424
• CVE Record: CVE-2026-7424
• AWS Security Bulletin 2026-022-AWS
• GitHub Security Advisory GHSA-wrhm-c99p-2p8g
• FreeRTOS-Plus-TCP Release V4.2.6
• FreeRTOS-Plus-TCP Release V4.4.1
• Patch Commit ca65d44 (V4.4.x branch)
• Patch Commit 0015547 (V4.2.x branch)
• FreeRTOS Official Site
• FreeRTOS LTS Libraries