CVE-2026-53003
pppoe: drop PFC frames
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 0.72 % · percentile 54 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the current PPPoE driver assumes an uncompressed (2-byte) protocol field. However, the generic PPP layer function ppp_input() is not aware of the negotiation result, and still accepts PFC frames. If a peer with a broken implementation or an attacker sends a frame with a compressed (1-byte) protocol field, the subsequent PPP payload is shifted by one byte. This causes the network header to be 4-byte misaligned, which may trigger unaligned access exceptions on some architectures. To reduce the attack surface, drop PPPoE PFC frames. Introduce ppp_skb_is_compressed_proto() helper function to be used in both ppp_generic.c and pppoe.c to avoid open-coding.
Weaknesses (CWE)
- CWE-20 — Improper Input Validation
References
- https://git.kernel.org/stable/c/cb3beef35ab5e0c1afca9fd7648c6ae499786377
- https://git.kernel.org/stable/c/ba758fdf1399f310b30098b6faa3fd043de47dd2
- https://git.kernel.org/stable/c/fcca1df05322bb04e344dd1178b54b76a08eb7c3
- https://git.kernel.org/stable/c/8a5e840babc5c0fbd10c73728a13192347771ec6
- https://git.kernel.org/stable/c/49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71
- https://git.kernel.org/stable/c/0cab5d077dd1efd2bd1a47271acc35894f945b4f
- https://git.kernel.org/stable/c/2b5c3c040d020e3ab3b9a8887031202d96843b1e
- https://git.kernel.org/stable/c/cc1ff87bce1ccd38410ab10960f576dcd17db679
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | Linux |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-38871
- GCVE · GCVE-0-2026-53003
CERT-FR advisories
- CERTFR-2026-AVI-1252 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1162 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1093 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1066 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1064 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0985 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0927 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0866 — Multiples vulnérabilités dans Microsoft Azure Linux · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0862 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.0 < 5.10.258cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.209cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.175cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.141cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.91cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.18.33cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 7.0.10
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 < cb3beef35ab5e0c1afca9fd7648c6ae499786377 ; affected 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 < ba758fdf1399f310b30098b6faa3fd043de47dd2 ; affected 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 < fcca1df05322bb04e344dd1178b54b76a08eb7c3 ; affected 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 < 8a5e840babc5c0fbd10c73728a13192347771ec6 ; affected 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 < 49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71 ; affected 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 < 0cab5d077dd1efd2bd1a47271acc35894f945b4f |
| Linux · Linux | affected 5.0 ; unaffected 0 < 5.0 ; unaffected 5.10.258 ≤ 5.10.* ; unaffected 5.15.209 ≤ 5.15.* ; unaffected 6.1.175 ≤ 6.1.* ; unaffected 6.6.141 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |