What is the CVSS score of CVE-2026-53003?

CVE-2026-53003 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux are affected by CVE-2026-53003?

A denial-of-service vulnerability (CVE-2026-53003, CVSS 7.5) in the Linux kernel's PPPoE/PPP driver allows remote network peers to crash affected systems through malformed network packets.. A patch is available.

How to fix or mitigate CVE-2026-53003?

24 hours: Audit all Linux systems with active PPPoE/PPP connections and document affected kernel versions across infrastructure. 7 days: Deploy vendor-released patches to all identified systems, coordinating with network operations to schedule maintenance windows. 30 days: Validate patch deployment through kernel version audits and functional testing of PPPoE/PPP connectivity.

Linux CVE-2026-53003

EUVD-2026-38871 HIGH

2026-06-24 Linux

GHSA-7g5v-54rw-hq9g

Linux Information Disclosure

7.5

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux) · only source for this CVE.

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 28, 2026 - 08:47 vuln.today

CVSS changed

Jun 28, 2026 - 08:22 NVD

7.5 (HIGH)

Patch available

Jun 24, 2026 - 18:02 EUVD

CVE Published

Jun 24, 2026 - 16:29 cve.org

HIGH 7.5

CVE Published

Jun 24, 2026 - 16:29 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

pppoe: drop PFC frames

RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the current PPPoE driver assumes an uncompressed (2-byte) protocol field. However, the generic PPP layer function ppp_input() is not aware of the negotiation result, and still accepts PFC frames.

If a peer with a broken implementation or an attacker sends a frame with a compressed (1-byte) protocol field, the subsequent PPP payload is shifted by one byte. This causes the network header to be 4-byte misaligned, which may trigger unaligned access exceptions on some architectures.

To reduce the attack surface, drop PPPoE PFC frames. Introduce ppp_skb_is_compressed_proto() helper function to be used in both ppp_generic.c and pppoe.c to avoid open-coding.

AnalysisAI

Denial of service in the Linux kernel's PPPoE/PPP driver allows a malicious or broken peer to crash affected hosts by sending PPP frames with a compressed (1-byte) Protocol Field. Because pppd never negotiates Protocol Field Compression for PPPoE yet ppp_input() still accepted compressed frames, the payload is shifted one byte, producing a 4-byte misaligned network header that can raise unaligned-access exceptions on architectures that do not tolerate them. …