CVE-2026-53003
pppoe: drop PFC frames
Description
In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the current PPPoE driver assumes an uncompressed (2-byte) protocol field. However, the generic PPP layer function ppp_input() is not aware of the negotiation result, and still accepts PFC frames. If a peer with a broken implementation or an attacker sends a frame with a compressed (1-byte) protocol field, the subsequent PPP payload is shifted by one byte. This causes the network header to be 4-byte misaligned, which may trigger unaligned access exceptions on some architectures. To reduce the attack surface, drop PPPoE PFC frames. Introduce ppp_skb_is_compressed_proto() helper function to be used in both ppp_generic.c and pppoe.c to avoid open-coding.
INFO
Published Date :
June 24, 2026, 5:17 p.m.
Last Modified :
July 14, 2026, 8:05 p.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to include the fix.
- Ensure the PPP layer handles protocol compression correctly.
- Avoid negotiation of PFC for PPPoE sessions.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53003.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53003 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53003
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53003 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53003 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 14, 2026
Action Type Old Value New Value Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.141 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.91 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.0 up to (excluding) 5.10.258 Added Reference Type kernel.org: https://git.kernel.org/stable/c/0cab5d077dd1efd2bd1a47271acc35894f945b4f Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/2b5c3c040d020e3ab3b9a8887031202d96843b1e Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/8a5e840babc5c0fbd10c73728a13192347771ec6 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ba758fdf1399f310b30098b6faa3fd043de47dd2 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/cb3beef35ab5e0c1afca9fd7648c6ae499786377 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/cc1ff87bce1ccd38410ab10960f576dcd17db679 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/fcca1df05322bb04e344dd1178b54b76a08eb7c3 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 28, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6', 'lessThan': 'cb3beef35ab5e0c1afca9fd7648c6ae499786377', 'versionType': 'git'}, {'status': 'affected', 'version': '7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6', 'lessThan': 'ba758fdf1399f310b30098b6faa3fd043de47dd2', 'versionType': 'git'}, {'status': 'affected', 'version': '7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6', 'lessThan': 'fcca1df05322bb04e344dd1178b54b76a08eb7c3', 'versionType': 'git'}, {'status': 'affected', 'version': '7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6', 'lessThan': '8a5e840babc5c0fbd10c73728a13192347771ec6', 'versionType': 'git'}, {'status': 'affected', 'version': '7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6', 'lessThan': '49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71', 'versionType': 'git'}, {'status': 'affected', 'version': '7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6', 'lessThan': '0cab5d077dd1efd2bd1a47271acc35894f945b4f', 'versionType': 'git'}, {'status': 'affected', 'version': '7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6', 'lessThan': '2b5c3c040d020e3ab3b9a8887031202d96843b1e', 'versionType': 'git'}, {'status': 'affected', 'version': '7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6', 'lessThan': 'cc1ff87bce1ccd38410ab10960f576dcd17db679', 'versionType': 'git'}], 'programFiles': ['drivers/net/ppp/ppp_generic.c', 'drivers/net/ppp/pppoe.c', 'include/linux/ppp_defs.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.141', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.91', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/ppp/ppp_generic.c', 'drivers/net/ppp/pppoe.c', 'include/linux/ppp_defs.h'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the current PPPoE driver assumes an uncompressed (2-byte) protocol field. However, the generic PPP layer function ppp_input() is not aware of the negotiation result, and still accepts PFC frames. If a peer with a broken implementation or an attacker sends a frame with a compressed (1-byte) protocol field, the subsequent PPP payload is shifted by one byte. This causes the network header to be 4-byte misaligned, which may trigger unaligned access exceptions on some architectures. To reduce the attack surface, drop PPPoE PFC frames. Introduce ppp_skb_is_compressed_proto() helper function to be used in both ppp_generic.c and pppoe.c to avoid open-coding. Added Reference https://git.kernel.org/stable/c/0cab5d077dd1efd2bd1a47271acc35894f945b4f Added Reference https://git.kernel.org/stable/c/2b5c3c040d020e3ab3b9a8887031202d96843b1e Added Reference https://git.kernel.org/stable/c/49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71 Added Reference https://git.kernel.org/stable/c/8a5e840babc5c0fbd10c73728a13192347771ec6 Added Reference https://git.kernel.org/stable/c/ba758fdf1399f310b30098b6faa3fd043de47dd2 Added Reference https://git.kernel.org/stable/c/cb3beef35ab5e0c1afca9fd7648c6ae499786377 Added Reference https://git.kernel.org/stable/c/cc1ff87bce1ccd38410ab10960f576dcd17db679 Added Reference https://git.kernel.org/stable/c/fcca1df05322bb04e344dd1178b54b76a08eb7c3