Linux Kernel CVE-2026-52073

MEDIUM

2026-08-13 vendor:ubuntu

Severity by source

vuln.today AI

7.1 HIGH

Adjacent vector because PPP requires an established peer session; OOB read yields kernel crash (A:H) and potential memory disclosure (C:L) with no integrity impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:21 vuln.today

DescriptionCVE.org

[ppp_handle_ipcp attacker-controlled IPCP length -- OOB read]

AnalysisAI

Out-of-bounds read in the Linux kernel's PPP subsystem via the ppp_handle_ipcp function allows a remote PPP peer to supply a crafted IPCP packet with an attacker-controlled length field, triggering an OOB read in kernel memory. Systems running any kernel version with PPP support enabled and an active PPP link are potentially affected. Reported by Ubuntu; no patch version, CVSS score, or KEV status is confirmed at time of analysis.

Technical ContextAI

PPP (Point-to-Point Protocol) is a data-link layer protocol widely used for broadband (PPPoE), dial-up, VPN tunnels (PPTP, L2TP), and embedded networking. IPCP (IP Control Protocol) is the Network Control Protocol negotiated over PPP to establish IPv4 parameters. The vulnerable function ppp_handle_ipcp processes incoming IPCP configuration packets. The flaw lies in insufficient validation of the length field carried within IPCP option TLVs or the IPCP header itself - a remote PPP peer can craft a packet with a manipulated length value, causing the kernel to read beyond the bounds of the allocated packet buffer. The root cause class maps to CWE-125 (Out-of-Bounds Read), which can manifest as kernel information disclosure (kernel memory leaked to the peer) or a kernel NULL/invalid pointer dereference leading to a panic. CWE is not formally assigned in the current NVD entry. No CPE string is available in the input data; the affected component is the Linux kernel ppp driver, typically found under drivers/net/ppp/ in the kernel source tree.

Affected ProductsAI

The affected product is the Linux kernel, specifically the PPP subsystem's ppp_handle_ipcp function. No CPE strings, exact kernel version ranges, or vendor advisory URLs are provided in the available intelligence. The vulnerability is reported by Ubuntu, suggesting at minimum Ubuntu-shipped kernel packages are affected, but the full upstream version range has not been confirmed. Administrators should monitor the Ubuntu Security Notices (USN) portal and the upstream Linux kernel changelog for authoritative version scope.

RemediationAI

No patch version or vendor advisory URL is confirmed in the available data. The vulnerability was reported by Ubuntu, so administrators should monitor Ubuntu Security Notices for an updated kernel package once published. As an interim compensating control, consider disabling the PPP kernel module if PPP-based connectivity (PPPoE, PPTP, L2TP with PPP) is not operationally required - this can be done by blacklisting the ppp_generic module (echo 'blacklist ppp_generic' >> /etc/modprobe.d/disable-ppp.conf), though this will disrupt any active PPP-dependent services such as DSL broadband or PPTP VPN. If PPP is required, restrict PPP session establishment to trusted peers only via firewall rules filtering L2TP (UDP/1701), PPTP (TCP/1723), or PPPoE frames at the network boundary, reducing exposure to untrusted remote peers who could supply malicious IPCP packets. Patch status: no vendor-released patch identified at time of analysis.