CVE-2026-93006 PUBLISHED

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

The following measures reduce risk:

1. If TFTP is not required, do not enable it. Remove --enable-tftp from the dnsmasq configuration.
2. If TFTP is required, restrict it with --tftp-interface=<interface> and avoid running TFTP-only instances that serve untrusted clients on the same network.
3. Compile without TFTP support using COPTS=-DNO_TFTP if TFTP is not needed.

• Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue.

• https://access.redhat.com/security/cve/CVE-2026-93006
• RHBZ#2536075

• Operation on a Resource after Expiration or Release CWE