pppd (PPP Daemon) CVE-2026-52054

MEDIUM

2026-08-13 vendor:ubuntu

Denial Of Service

Severity by source

vuln.today AI

6.5 MEDIUM

Adjacent vector as PPP peer required; no auth needed before negotiation; only availability impacted via infinite loop.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 17:39 vuln.today

DescriptionCVE.org

[find_opt zero-length PPP option -- infinite loop]

AnalysisAI

Infinite loop in PPP option parsing exposes the pppd daemon to denial-of-service when a zero-length PPP option is encountered during link negotiation. Affected systems running pppd can be hung indefinitely by a malicious or malformed peer that sends a crafted LCP/NCP option with zero length, causing the find_opt function to spin without advancing its parse cursor. No patch version or CVSS data is available at time of analysis; exploitation conditions and scope are inferred from the description and Ubuntu vendor report alone.

Technical ContextAI

PPP (Point-to-Point Protocol, RFC 1661) negotiates link parameters through option lists carried in LCP and NCP packets. Each option has a type, a length field, and data. The find_opt function iterates over these options by advancing a pointer by the declared length of each option. When a zero-length option is crafted or malformed, the length field is 0, so the pointer is never advanced - the loop condition is never met, resulting in an infinite loop (CWE-835: Loop with Unreachable Exit Condition). The vulnerability is in the option-parsing layer of pppd, the userspace PPP daemon shipped by Ubuntu and most Linux distributions. No CPE string was provided; the affected component is inferred as pppd on Ubuntu Linux.

Affected ProductsAI

The affected product is pppd as packaged and reported by Ubuntu (vendor source). The exact affected version range is not specified in the available intelligence - no CPE strings, no NVD version data, and no vendor advisory URL were provided. The vulnerability exists in the find_opt function within the PPP option parser. Users should consult Ubuntu Security Notices (USN) and the upstream pppd project for authoritative version ranges. All Ubuntu releases shipping pppd with an unpatched find_opt function should be considered potentially affected until the vendor confirms fixed versions.

RemediationAI

No exact fix version is confirmed from available data. Users should monitor Ubuntu Security Notices at ubuntu.com/security/notices for a USN addressing CVE-2026-52054 and apply the pppd package update as soon as it is released. As a compensating control, restrict which peers can initiate PPP sessions - use firewall rules or access control lists to limit PPP negotiation to known, trusted endpoints only, reducing exposure to malicious peers. Where pppd is not actively required, disable or remove the service entirely. If pppd runs as a daemon, consider deploying a watchdog or process supervisor (e.g., systemd with Restart=on-failure) to automatically restart a hung process, mitigating availability impact at the cost of brief connectivity interruption. No upstream patch commit or GitHub PR was referenced in the provided data.