Skip to main content

Linux Kernel CVE-2026-46306

| EUVDEUVD-2026-35171 HIGH
2026-06-08 Linux GHSA-vm8v-fr63-mfh4
Information Disclosure Linux Debian
7.5
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain L2 adjacency to target interface
  2. Delivery
    Craft PPPoE frame with PFC-compressed protocol byte
  3. Exploit
    Send to RPS-enabled NIC
  4. Execution
    Flow dissector mis-shifts network header
  5. Persist
    Unaligned access exception on MIPS
  6. Impact
    Kernel panic and device DoS

Vulnerability Assessment

Exploitation Conditions

Target must run Linux kernel 6.0 through the unpatched stable branches on an architecture that faults on unaligned 32-bit loads (the reproducer is a MIPS 1004Kc board, and other MIPS/older ARM/SPARC systems are likely candidates; x86_64 and modern ARM64 silently handle unaligned access and will not panic). The vulnerable code path requires the flow dissector to run on received frames, which in the reproducer is driven by RPS being enabled on the receiving Ethernet interface (also reachable via RFS, aRFS, or any other __skb_flow_dissect caller on the RX path). The attacker must be able to deliver a PPPoE-EtherType (0x8863/0x8864) frame with the protocol field's low bit set (PFC-compressed) to that interface - typically requiring L2 adjacency, since routers do not normally forward PPPoE EtherTypes - but no PPPoE session needs to be active on the target interface. Limiting factors: not exploitable on alignment-tolerant CPUs, requires RPS-class feature enabled, and generally requires same-segment access.
Impact

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 (High) based on remote, unauthenticated, low-complexity availability impact, which is consistent with a single L2-adjacent or routed PPPoE frame crashing the receive path. However, the EPSS score of 0.02% (7th percentile) and absence of KEV listing or public PoC indicate negligible real-world exploitation likelihood. There is also a significant gap between CVSS and practical risk: only architectures intolerant of unaligned access (notably MIPS and some older ARM/SPARC configurations) are panic-affected, and the attacker must be able to deliver a raw PPPoE EtherType (0x8864/0x8863) frame to an Ethernet interface with RPS/flow-dissector usage enabled - usually meaning L2 adjacency or a misconfigured bridge. For x86_64 servers this is unlikely to be a panic-class issue; for MIPS-based network appliances (routers, CPE devices using mtk_eth_soc as in the trace), it is a credible local-DoS primitive.
Exploit ScenarioDerived

An attacker on the same broadcast domain as a vulnerable MIPS-based router or CPE crafts a single Ethernet frame with EtherType 0x8864 (PPPoE session) and sets the PPP protocol field's low bit to indicate a compressed 1-byte protocol, then sends it to the device's LAN interface. When RPS picks up the frame and calls __skb_flow_dissect, the misaligned 4-byte load at the network header triggers an unaligned access exception, panicking the kernel and dropping the device offline until reboot. No PPPoE session needs to exist on the target interface, and no public PoC has been published at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 14, 2026

Denial of service in the Linux kernel flow dissector allows remote attackers to trigger an unaligned access exception by sending crafted PPPoE Protocol Field Compression (PFC) frames to an Ethernet interface on alignment-sensitive architectures such as MIPS. The flaw affects kernels from 6.0 onward where Receive Packet Steering (RPS) or similar features invoke the flow dissector on incoming frames, and no PPPoE session needs to be active on the targeted interface. EPSS is very low (0.02%) and there is no public exploit identified at time of analysis, but the vendor has released patched kernel versions.

RemediationAI

Vendor-released patch: upgrade to Linux 6.1.175, 6.6.140, 6.12.88, 6.18.30, 7.0.7, or 7.1-rc1 (or later) from the corresponding stable series, applying the upstream commits at https://git.kernel.org/stable/c/e7c811ca372d53c2be7d01a1614e71fae1054836 and its backports. For Debian and other distributions, pull the security update once the backport lands. Where immediate kernel upgrade is not possible on MIPS or other alignment-sensitive devices, compensating controls include disabling RPS on affected interfaces (echo 0 > /sys/class/net/<iface>/queues/rx-*/rps_cpus), which removes the flow-dissector invocation on the RX path at the cost of single-CPU softirq handling and reduced throughput on multi-core systems, or filtering inbound PPPoE EtherTypes 0x8863/0x8864 at the edge on interfaces that are not legitimate PPPoE termination points (this will break any actual PPPoE service on that link). Disabling features such as RFS/aRFS and XDP flow-hash paths similarly avoids the dissector for raw RX but has equivalent throughput trade-offs.

Affected VersionsENISA

Linux patch: 6.18.30
Linux 10f665b52a75df6eb26ddebbbc072ee264183731 <e7c811ca372d53c2be7d01a1614e71fae1054836
Linux 46126db9c86110e5fc1e369b9bb89735ddefdae4 <7c93f353eab4ea911e394630f07d72e040a729d8
Linux patch: 7.0.7
Linux 46126db9c86110e5fc1e369b9bb89735ddefdae4 <0d00b9015069712944934bab09eaa6c542143049
Linux 6.0
Linux 46126db9c86110e5fc1e369b9bb89735ddefdae4 <18ae9eacfc95cc715c0606b2c86e8aa8a86cf3e3
Linux 46126db9c86110e5fc1e369b9bb89735ddefdae4 <db104b0d8a7856397c0469d83a4289adf7c54863
Linux 46126db9c86110e5fc1e369b9bb89735ddefdae4 <6044392d9cace3a3672b02c8bc7d38b502e51734
Linux 46126db9c86110e5fc1e369b9bb89735ddefdae4 <d6c19b31a3c1d519fabdcf0aa239e6b6109b9473
Linux d7e541e86122d21f71eb71c5dfa7fb1eb6623fe8 <abc5bc84e0f2edc7ea2d437afa6ef3fe1fc43200
Linux patch: 6.12.88
Linux patch: 0
Linux patch: 6.6.140
Linux patch: 7.1-rc1
Linux patch: 6.1.175

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability is in net/core/flow_dissector.c (__skb_flow_dissect), which parses incoming packets to derive flow hashes for features like RPS, RFS, and aRFS. RFC 2516 Section 7 explicitly does NOT RECOMMEND Protocol Field Compression for PPPoE, and pppd does not negotiate it, so the dissector previously assumed an uncompressed 2-byte protocol field. A prior commit added speculative PFC support, but a 1-byte compressed protocol field shifts the subsequent PPP payload by one byte and misaligns the network header by 4 bytes. On architectures that do not transparently handle unaligned access (e.g. MIPS 1004Kc, as shown in the oops trace at __skb_flow_dissect+0x1b0/0x1b50), this triggers an alignment exception and kernel panic. The CPE strings cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* identify the upstream Linux kernel; the fix is to skip dissection of PPPoE PFC frames entirely.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.3 MEDIUM

PPPoE EtherTypes are L2-adjacent (AV:A); panic only on alignment-intolerant CPUs with RPS-class features enabled (AC:H); unauthenticated availability-only kernel crash.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 14, 2026 - 06:22 NVD
7.5 (HIGH)
Patch available
Jun 08, 2026 - 18:01 EUVD
CVE Published
Jun 08, 2026 - 15:46 cve.org
HIGH 7.5
CVE Published
Jun 08, 2026 - 15:46 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

flow_dissector: do not dissect PPPoE PFC frames

RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the flow dissector driver has assumed an uncompressed frame until the blamed commit.

During the review process of that commit [1], support for PFC is suggested. However, having a compressed (1-byte) protocol field means the subsequent PPP payload is shifted by one byte, causing 4-byte misalignment for the network header and an unaligned access exception on some architectures.

The exception can be reproduced by sending a PPPoE PFC frame to an ethernet interface of a MIPS board, with RPS enabled, even if no PPPoE session is active on that interface:

$ 0 : 00000000 80c40000 00000000 85144817 $ 4 : 00000008 00000100 80a75758 81dc9bb8 $ 8 : 00000010 8087ae2c 0000003d 00000000 $12 : 000000e0 00000039 00000000 00000000 $16 : 85043240 80a75758 81dc9bb8 00006488 $20 : 0000002f 00000007 85144810 80a70000 $24 : 81d1bda0 00000000 $28 : 81dc8000 81dc9aa8 00000000 805ead08 Hi : 00009d51 Lo : 2163358a epc : 805e91f0 __skb_flow_dissect+0x1b0/0x1b50 ra : 805ead08 __skb_get_hash_net+0x74/0x12c Status: 11000403 KERNEL EXL IE Cause : 40800010 (ExcCode 04) BadVA : 85144817 PrId : 0001992f (MIPS 1004Kc) Call Trace: [<805e91f0>] __skb_flow_dissect+0x1b0/0x1b50 [<805ead08>] __skb_get_hash_net+0x74/0x12c [<805ef330>] get_rps_cpu+0x1b8/0x3fc [<805fca70>] netif_receive_skb_list_internal+0x324/0x364 [<805fd120>] napi_complete_done+0x68/0x2a4 [<8058de5c>] mtk_napi_rx+0x228/0xfec [<805fd398>] __napi_poll+0x3c/0x1c4 [<805fd754>] napi_threaded_poll_loop+0x234/0x29c [<805fd848>] napi_threaded_poll+0x8c/0xb0 [<80053544>] kthread+0x104/0x12c [<80002bd8>] ret_from_kernel_thread+0x14/0x1c

Code: 02d51821 1060045b 00000000 <8c640000> 3084000f 2c820005 144001a2 00042080 8e220000

To reduce the attack surface and maintain performance, do not process PPPoE PFC frames.

[1] https://lore.kernel.org/r/20220630231016.GA392@debian.home

Executive ViewAI

Why It Matters

Linux kernel versions 6.0 and later running on alignment-sensitive architectures (such as MIPS) with Receive Packet Steering enabled are vulnerable to denial of service attacks via specially crafted Ethernet frames. Remote attackers can trigger unaligned access exceptions that disrupt system availability without requiring authentication or prior network session. Organizations operating these specific kernel and architecture combinations face potential service interruptions.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Medium

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46306 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/369235 REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/0d00b9015069712944934bab09eaa6c542143049 REF https://git.kernel.org/stable/c/18ae9eacfc95cc715c0606b2c86e8aa8a86cf3e3 REF https://git.kernel.org/stable/c/6044392d9cace3a3672b02c8bc7d38b502e51734 REF https://git.kernel.org/stable/c/7c93f353eab4ea911e394630f07d72e040a729d8 REF https://git.kernel.org/stable/c/abc5bc84e0f2edc7ea2d437afa6ef3fe1fc43200 REF https://git.kernel.org/stable/c/d6c19b31a3c1d519fabdcf0aa239e6b6109b9473 REF https://git.kernel.org/stable/c/db104b0d8a7856397c0469d83a4289adf7c54863 REF https://git.kernel.org/stable/c/e7c811ca372d53c2be7d01a1614e71fae1054836

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy