CVE-2026-53003
published 2026-06-24CVE-2026-53003: In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.51%
40.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
pppoe: drop PFC frames
RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT
RECOMMENDED for PPPoE. In practice, pppd does not support negotiating
PFC for PPPoE sessions, and the current PPPoE driver assumes an
uncompressed (2-byte) protocol field. However, the generic PPP layer
function ppp_input() is not aware of the negotiation result, and still
accepts PFC frames.
If a peer with a broken implementation or an attacker sends a frame with
a compressed (1-byte) protocol field, the subsequent PPP payload is
shifted by one byte. This causes the network header to be 4-byte
misaligned, which may trigger unaligned access exceptions on some
architectures.
To reduce the attack surface, drop PPPoE PFC frames. Introduce
ppp_skb_is_compressed_proto() helper function to be used in both
ppp_generic.c and pppoe.c to avoid open-coding.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 < cb3beef35ab5e0c1afca9fd7648c6ae499786377 | cb3beef35ab5e0c1afca9fd7648c6ae499786377 |
| linux | linux | >= 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 < ba758fdf1399f310b30098b6faa3fd043de47dd2 | ba758fdf1399f310b30098b6faa3fd043de47dd2 |
| linux | linux | >= 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 < fcca1df05322bb04e344dd1178b54b76a08eb7c3 | fcca1df05322bb04e344dd1178b54b76a08eb7c3 |
| linux | linux | >= 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 < 8a5e840babc5c0fbd10c73728a13192347771ec6 | 8a5e840babc5c0fbd10c73728a13192347771ec6 |
| linux | linux | >= 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 < 49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71 | 49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71 |
| linux | linux | >= 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 < 0cab5d077dd1efd2bd1a47271acc35894f945b4f | 0cab5d077dd1efd2bd1a47271acc35894f945b4f |
| linux | linux | >= 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 < 2b5c3c040d020e3ab3b9a8887031202d96843b1e | 2b5c3c040d020e3ab3b9a8887031202d96843b1e |
| linux | linux | >= 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 < cc1ff87bce1ccd38410ab10960f576dcd17db679 | cc1ff87bce1ccd38410ab10960f576dcd17db679 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.0 < 5.10.258 | 5.10.258 |
| linux | linux_kernel | >= 5.11 < 5.15.209 | 5.15.209 |
| linux | linux_kernel | >= 5.16 < 6.1.175 | 6.1.175 |
| linux | linux_kernel | >= 6.13 < 6.18.33 | 6.18.33 |
| linux | linux_kernel | >= 6.19 < 7.0.10 | 7.0.10 |
| linux | linux_kernel | >= 6.2 < 6.6.141 | 6.6.141 |
| linux | linux_kernel | >= 6.7 < 6.12.91 | 6.12.91 |
| ubuntu | linux | — | — |
| ubuntu | linux-gcp | — | — |
| ubuntu | linux-gcp-6.8 | — | — |
| ubuntu | linux-gke | — | — |
| ubuntu | linux-gkeop | — | — |
| ubuntu | linux-hwe-7.0 | — | — |
| ubuntu | linux-oem-7.0 | — | — |
| ubuntu | linux-realtime | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_ubuntu7.0HIGH
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 7.0
CVE-2026-46108 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PSP security protocol;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Intel NPU Driver;
- DRBD D
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TC
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 7.0
CVE-2026-46113 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PSP security protocol;
- ARM64 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Intel NPU Driver;
- DRBD Distrib
Red Hat
kernel: pppoe: drop PFC frames
vendor_redhat·2026-06-24·CVSS 5.5
CVE-2026-53003 [MEDIUM] CWE-1102 kernel: pppoe: drop PFC frames
kernel: pppoe: drop PFC frames
A flaw was found in the Linux kernel's Point-to-Point Protocol over Ethernet (PPPoE) driver. A remote attacker or a peer with a misconfigured implementation could send specially crafted Protocol Field Compression (PFC) frames. This could lead to a one-byte shift in the PPP payload, causing a four-byte misalignment of the network header. On certain architectures, this misalignment may trigger unaligned access exceptions, potentially leading to a denial of service or system instability.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Ente
VulDB
Linux Kernel up to 7.0.9 PPPoE ppp_generic.c ppp_input state issue (WID-SEC-2026-2077)
vuldb·2026-06-27
CVE-2026-53003 [CRITICAL] Linux Kernel up to 7.0.9 PPPoE ppp_generic.c ppp_input state issue (WID-SEC-2026-2077)
A vulnerability labeled as critical has been found in Linux Kernel up to 7.0.9. This impacts the function ppp_input of the file ppp_generic.c of the component PPPoE. The manipulation results in state issue.
This vulnerability is cataloged as CVE-2026-53003. The attack must originate from the local network. There is no exploit available.
The affected component should be upgraded.
GHSA
In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE.
ghsa_unreviewed·2026-06-24
CVE-2026-53003 In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE.
In the Linux kernel, the following vulnerability has been resolved:
pppoe: drop PFC frames
RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT
RECOMMENDED for PPPoE. In practice, pppd does not support negotiating
PFC for PPPoE sessions, and the current PPPoE driver assumes an
uncompressed (2-byte) protocol field. However, the generic PPP layer
function ppp_input() is not aware of the negotiation result, and still
accepts PFC frames.
If a peer with a broken implementation or an attacker sends a frame with
a compressed (1-byte) protocol field, the subsequent PPP payload is
shifted by one byte. This causes the network header to be 4-byte
misaligned, which may trigger unaligned access exceptions on some
architectures.
To reduce the attack surface, drop PPPoE PFC frames.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0cab5d077dd1efd2bd1a47271acc35894f945b4fhttps://git.kernel.org/stable/c/2b5c3c040d020e3ab3b9a8887031202d96843b1ehttps://git.kernel.org/stable/c/49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71https://git.kernel.org/stable/c/8a5e840babc5c0fbd10c73728a13192347771ec6https://git.kernel.org/stable/c/ba758fdf1399f310b30098b6faa3fd043de47dd2https://git.kernel.org/stable/c/cb3beef35ab5e0c1afca9fd7648c6ae499786377https://git.kernel.org/stable/c/cc1ff87bce1ccd38410ab10960f576dcd17db679https://git.kernel.org/stable/c/fcca1df05322bb04e344dd1178b54b76a08eb7c3
2026-06-24
Published