Skip to main content

Linux Kernel CVE-2026-43080

| EUVDEUVD-2026-27571 MEDIUM
Uncontrolled Recursion (CWE-674)
2026-05-06 Linux GHSA-pmcg-f5m4-2gwp
Buffer Overflow Linux Debian
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain low-priv local shell
  2. Delivery
    Load/access l2tp_ppp module
  3. Exploit
    Create PPPoL2TP socket over UDP
  4. Execution
    Call writev() with 212 KB payload
  5. Persist
    Trigger 16-bit length truncation in l2tp_xmit_core
  6. Impact
    Send malformed UDP frame, disrupt tunnel

Vulnerability Assessment

Weakness
CWE
CWE-674
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
Exploitation Conditions

Exploitation requires: (1) local authenticated access to the target system with at minimum low-privilege credentials (CVSS PR:L); (2) the ability to create raw L2TP and UDP sockets, which typically requires CAP_NET_ADMIN or a permissive socket policy - unprivileged users on hardened systems are blocked at socket creation; (3) the l2tp_core and l2tp_ppp kernel modules loaded (they may be auto-loaded on-demand); (4) UDP encapsulation mode (as opposed to IP encapsulation) configured for the L2TP tunnel. Exploitation is impossible remotely (AV:L confirmed). The bug is limited to the transmit path - receiving oversized packets does not trigger it. Systems where untrusted users cannot create PPPoL2TP sockets (e.g., due to seccomp, AppArmor, SELinux policy, or absence of the l2tp_ppp module) are not exploitable regardless of kernel version.
Impact

Real-world risk is moderate-to-low despite the CVSS Availability:High rating. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) requires local system access and a low-privileged account - remote network exploitation is not possible. EPSS is 0.02% at the 5th percentile, consistent with narrow exploitability. There is no CISA KEV listing, confirming no observed in-the-wild exploitation. The practical impact in production kernels without the upstream WARN patch is silent transmission of malformed UDP frames, which disrupts L2TP tunnels; a kernel WARN is triggered in debug builds. There is no confidentiality or integrity impact. The primary concern is environments where untrusted local users can create PPPoL2TP sockets, such as multi-tenant VPS hosts or systems with overly permissive socket capabilities. The CWE mis-classification (CWE-674 vs. the actual integer truncation) may cause automated triage tools to misweight this finding - defenders should assess it as an integer overflow/truncation issue, not uncontrolled recursion.
Exploit ScenarioDerived

A local user with a low-privileged account on an affected Linux system creates a PPPoL2TP socket bound over a UDP IPv6 socket, then calls writev() with a buffer of approximately 212 KB (exceeding the 65535-byte UDP length limit). The l2tp_xmit_core() function assigns the oversized length to the 16-bit UDP length field without bounds checking, causing the value to be silently truncated; the resulting malformed packet is transmitted, disrupting the L2TP tunnel and triggering a kernel WARN in debug builds. No exploit code beyond the syzbot reproducer is publicly available, but the reproducer is fully documented in the patch discussion thread at https://lore.kernel.org/all/20260226201600.222044-1-alice.kernel@fastmail.im/.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 01, 2026

Integer overflow in the Linux kernel's l2tp subsystem allows a local low-privileged attacker to cause a denial of service by sending oversized packets through a PPPoL2TP socket with UDP encapsulation. In l2tp_xmit_core() (net/l2tp/l2tp_core.c:1293), the UDP length field - constrained to 16 bits - is assigned a packet length value without any bounds check, silently truncating values exceeding 65535 bytes and producing malformed UDP frames on the wire or triggering a kernel WARN. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but a syzbot reproducer is publicly documented in the upstream patch discussion.

RemediationAI

The primary fix is to upgrade to a patched stable kernel release: Linux 6.6.136 or later, 6.12.83 or later, 6.18.24 or later, 6.19.14 or later, or 7.0 (patched). Upstream fix commits are available at https://git.kernel.org/stable/c/9ccce02d501335f59a02f26c878c5e095b16302f (6.6.x), https://git.kernel.org/stable/c/77c1489398c85a844f90205f5e76fd6bc8bb4089 (6.12.x), https://git.kernel.org/stable/c/86534c97abd6365a9a021fd767a2023e63c44469 (6.19.x), and https://git.kernel.org/stable/c/f295fe86e22ff0a2ecebf05e30a387e5cf6f6ddc (mainline). As a compensating control where patching is not immediately feasible, restrict creation of L2TP and PPPoL2TP sockets by limiting the CAP_NET_ADMIN and related socket capabilities to trusted users only, using seccomp profiles or LSM (AppArmor/SELinux) rules to block socket$pppl2tp and socket$inet6_udp combinations from untrusted processes. Trade-off: this may break legitimate L2TP VPN use cases on the host. Unloading or blacklisting the l2tp_core and l2tp_ppp kernel modules (if not in use) eliminates the attack surface entirely but disables L2TP functionality.

Affected VersionsENISA

Linux patch: 6.19.14
Linux patch: 6.12.83
Linux patch: 6.6.136
Linux patch: 6.18.24
Linux 3557baabf28088f49bdf72a048fd33ab62e205b1 <9ccce02d501335f59a02f26c878c5e095b16302f
Linux patch: 0
Linux 3557baabf28088f49bdf72a048fd33ab62e205b1 <77c1489398c85a844f90205f5e76fd6bc8bb4089
Linux 3557baabf28088f49bdf72a048fd33ab62e205b1 <ebe560ea5f54134279356703e73b7f867c89db13
Linux 3557baabf28088f49bdf72a048fd33ab62e205b1 <86534c97abd6365a9a021fd767a2023e63c44469
Linux 2.6.23
Linux 3557baabf28088f49bdf72a048fd33ab62e205b1 <f295fe86e22ff0a2ecebf05e30a387e5cf6f6ddc
Linux patch: 7.0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The L2TP (Layer 2 Tunneling Protocol) kernel implementation in net/l2tp/l2tp_core.c supports UDP encapsulation, where L2TP control and data frames are wrapped in UDP datagrams. The UDP header carries a 16-bit length field per RFC 768, capping the maximum datagram size at 65535 bytes. The function l2tp_xmit_core() constructs the outbound UDP header by assigning the computed payload length directly to this 16-bit field without an overflow guard. When a caller (e.g., pppol2tp_sendmsg() via writev()) passes a buffer exceeding 65535 bytes - as syzbot demonstrated with 0x34000 (212992) bytes - the assignment silently truncates the value, violating protocol semantics. The CWE classification supplied is CWE-674 (Uncontrolled Recursion), which does not accurately describe this bug; the root cause is integer truncation/overflow (more precisely CWE-190 or CWE-682). The 'Buffer Overflow' tag is also imprecise - this is a value-truncation issue in a header field, not a memory buffer overflow. CPE indicates all Linux kernel versions in the cpe:2.3:a:linux:linux:* range are affected, with the vulnerability introduced in Linux 2.6.23 (commit 3557baabf28).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
Jun 01, 2026 - 17:37 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 11:31 EUVD
CVE Published
May 06, 2026 - 07:40 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

l2tp: Drop large packets with UDP encap

syzbot reported a WARN on my patch series [1]. The actual issue is an overflow of 16-bit UDP length field, and it exists in the upstream code. My series added a debug WARN with an overflow check that exposed the issue, that's why syzbot tripped on my patches, rather than on upstream code.

syzbot's repro:

r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0xfffffffc}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0xffff, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x32) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)="ee", 0x34000}], 0x1)

It basically sends an oversized (0x34000 bytes) PPPoL2TP packet with UDP encapsulation, and l2tp_xmit_core doesn't check for overflows when it assigns the UDP length field. The value gets trimmed to 16 bites.

Add an overflow check that drops oversized packets and avoids sending packets with trimmed UDP length to the wire.

syzbot's stack trace (with my patch applied):

len >= 65536u WARNING: ./include/linux/udp.h:38 at udp_set_len_short include/linux/udp.h:38 [inline], CPU#1: syz.0.17/5957 WARNING: ./include/linux/udp.h:38 at l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline], CPU#1: syz.0.17/5957 WARNING: ./include/linux/udp.h:38 at l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327, CPU#1: syz.0.17/5957 Modules linked in: CPU: 1 UID: 0 PID: 5957 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:udp_set_len_short include/linux/udp.h:38 [inline] RIP: 0010:l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline] RIP: 0010:l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327 Code: 0f 0b 90 e9 21 f9 ff ff e8 e9 05 ec f6 90 0f 0b 90 e9 8d f9 ff ff e8 db 05 ec f6 90 0f 0b 90 e9 cc f9 ff ff e8 cd 05 ec f6 90 <0f> 0b 90 e9 de fa ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 4f RSP: 0018:ffffc90003d67878 EFLAGS: 00010293 RAX: ffffffff8ad985e3 RBX: ffff8881a6400090 RCX: ffff8881697f0000 RDX: 0000000000000000 RSI: 0000000000034010 RDI: 000000000000ffff RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff520007acf00 R12: ffff8881baf20900 R13: 0000000000034010 R14: ffff8881a640008e R15: ffff8881760f7000 FS: 000055557e81f500(0000) GS:ffff8882a9467000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000033000 CR3: 00000001612f4000 CR4: 00000000000006f0 Call Trace: <TASK> pppol2tp_sendmsg+0x40a/0x5f0 net/l2tp/l2tp_ppp.c:302 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] sock_write_iter+0x503/0x550 net/socket.c:1195 do_iter_readv_writev+0x619/0x8c0 fs/read_write.c:-1 vfs_writev+0x33c/0x990 fs/read_write.c:1059 do_writev+0x154/0x2e0 fs/read_write.c:1105 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f636479c629 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffffd4241c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007f6364a15fa0 RCX: 00007f636479c629 RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003 RBP: 00007f6364832b39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6364a15fac R14: 00007f6364a15fa0 R15: 00007f6364a15fa0 </TASK>

[1]: https://lore.kernel.org/all/20260226201600.222044-1-alice.kernel@fastmail.im/

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2026-66393 HIGH POC
8.7
CVE-2026-18140 HIGH POC
8.7
CVE-2026-93687 HIGH POC
8.7
CVE-2026-9769 HIGH POC
8.7

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43080 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://vuldb.com/vuln/361316 REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/02d787fd0922c71c0264449fe82d35983613e4e5 REF https://git.kernel.org/stable/c/77c1489398c85a844f90205f5e76fd6bc8bb4089 REF https://git.kernel.org/stable/c/86534c97abd6365a9a021fd767a2023e63c44469 REF https://git.kernel.org/stable/c/9ccce02d501335f59a02f26c878c5e095b16302f REF https://git.kernel.org/stable/c/a42452db035577e150ffd9adf98c56fef9fb9408 REF https://git.kernel.org/stable/c/c2994fd24997ed63d713c03313f863645adb4d6c REF https://git.kernel.org/stable/c/ebe560ea5f54134279356703e73b7f867c89db13 REF https://git.kernel.org/stable/c/f295fe86e22ff0a2ecebf05e30a387e5cf6f6ddc

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy