CVE-2026-53003

pppoe: drop PFC frames

State: Published
Severity: 7.5 High
Published: Jun 24, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

pppoe: drop PFC frames

RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the current PPPoE driver assumes an uncompressed (2-byte) protocol field. However, the generic PPP layer function ppp_input() is not aware of the negotiation result, and still accepts PFC frames.

If a peer with a broken implementation or an attacker sends a frame with a compressed (1-byte) protocol field, the subsequent PPP payload is shifted by one byte. This causes the network header to be 4-byte misaligned, which may trigger unaligned access exceptions on some architectures.

To reduce the attack surface, drop PPPoE PFC frames. Introduce ppp_skb_is_compressed_proto() helper function to be used in both ppp_generic.c and pppoe.c to avoid open-coding.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
LinuxLinux	7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before cb3beef35ab5e0c1afca9fd7648c6ae499786377Affected 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before ba758fdf1399f310b30098b6faa3fd043de47dd2Affected 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before fcca1df05322bb04e344dd1178b54b76a08eb7c3Affected 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before 8a5e840babc5c0fbd10c73728a13192347771ec6Affected 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before 49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71Affected 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before 0cab5d077dd1efd2bd1a47271acc35894f945b4fAffected 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before 2b5c3c040d020e3ab3b9a8887031202d96843b1eAffected 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before cc1ff87bce1ccd38410ab10960f576dcd17db679Affected
LinuxLinux	5.0Affected before 5.0Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before cb3beef35ab5e0c1afca9fd7648c6ae499786377Affected
7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before ba758fdf1399f310b30098b6faa3fd043de47dd2Affected
7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before fcca1df05322bb04e344dd1178b54b76a08eb7c3Affected
7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before 8a5e840babc5c0fbd10c73728a13192347771ec6Affected
7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before 49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71Affected
7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before 0cab5d077dd1efd2bd1a47271acc35894f945b4fAffected
7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before 2b5c3c040d020e3ab3b9a8887031202d96843b1eAffected
7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 to before cc1ff87bce1ccd38410ab10960f576dcd17db679Affected

LinuxLinux

5.0Affected
before 5.0Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.