Log in Start free

Vulnerability · Published Jun 24, 2026 · Assigned by Linux

CVE-2026-53003pppoe: drop PFC frames

High 7.5

In plain English

A high-severity improper input validation in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 46.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the current PPPoE driver assumes an uncompressed (2-byte) protocol field. However, the generic PPP layer function ppp_input() is not aware of the negotiation result, and still accepts PFC frames. If a peer with a broken implementation or an attacker sends a frame with a compressed (1-byte) protocol field, the subsequent PPP payload is shifted by one byte. This causes the network header to be 4-byte misaligned, which may trigger unaligned access exceptions on some architectures. To reduce the attack surface, drop PPPoE PFC frames. Introduce ppp_skb_is_compressed_proto() helper function to be used in both ppp_generic.c and pppoe.c to avoid open-coding.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.176-1DEBIAN-CVE-2026-53003
Debian:13linux6.12.94-1DEBIAN-CVE-2026-53003
Debian:14linux7.0.10-1DEBIAN-CVE-2026-53003
Ubuntu:22.04:LTSlinux5.15.0-186.196UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux6.8.0-136.136UBUNTU-CVE-2026-53003
Ubuntu:25.10linuxno fix listedUBUNTU-CVE-2026-53003
Ubuntu:26.04:LTSlinux7.0.0-28.28UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-aws5.15.0-1112.119UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-aws6.8.0-1061.64UBUNTU-CVE-2026-53003
Ubuntu:25.10linux-awsno fix listedUBUNTU-CVE-2026-53003
Ubuntu:26.04:LTSlinux-aws7.0.0-1009.9UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1061.64~22.04.1UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-azure5.15.0-1117.126UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-azure6.8.0-1063.71UBUNTU-CVE-2026-53003
Ubuntu:25.10linux-azureno fix listedUBUNTU-CVE-2026-53003
Ubuntu:26.04:LTSlinux-azure7.0.0-1010.10UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1063.71~22.04.1UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-azure-7.07.0.0-1014.14~24.04.1UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1117.126UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-azure-fde6.8.0-1062.69UBUNTU-CVE-2026-53003
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2026-53003
Ubuntu:26.04:LTSlinux-azure-fde7.0.0-1009.9UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-azure-fde-6.86.8.0-1062.69~22.04.1UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-azure-fde-7.07.0.0-1013.13~24.04.1UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-gcp5.15.0-1112.122UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-gcp6.8.0-1064.72UBUNTU-CVE-2026-53003
Ubuntu:25.10linux-gcpno fix listedUBUNTU-CVE-2026-53003
Ubuntu:26.04:LTSlinux-gcp7.0.0-1008.8UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1064.72~22.04.1UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-gcp-7.07.0.0-1011.11~24.04.1UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-gke5.15.0-1108.114UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-gke6.8.0-1059.67UBUNTU-CVE-2026-53003
Ubuntu:26.04:LTSlinux-gke7.0.0-1003.4UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1095.103UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1046.50UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-136.136~22.04.1UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-28.28~24.04.1UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-ibm5.15.0-1106.110UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-ibm6.8.0-1061.62UBUNTU-CVE-2026-53003
Ubuntu:26.04:LTSlinux-ibm7.0.0-1010.10UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1061.62~22.04.1UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1107.113UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-kvm5.15.0-1104.109UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-184.194UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-136.136.2UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-136.136.2~22.04.1UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1107.108UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1059.62UBUNTU-CVE-2026-53003
Ubuntu:26.04:LTSlinux-nvidia7.0.0-1016.16UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1059.62~22.04.1UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-nvidia-7.07.0.0-1016.16~24.04.1UBUNTU-CVE-2026-53003
Ubuntu:26.04:LTSlinux-nvidia-bos7.0.0-2016.16UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1059.62.1UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1064.66UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1030.31UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1053.53UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-53003
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1009.9UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-oracle5.15.0-1109.115UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-oracle6.8.0-1058.61UBUNTU-CVE-2026-53003
Ubuntu:25.10linux-oracleno fix listedUBUNTU-CVE-2026-53003
Ubuntu:26.04:LTSlinux-oracle7.0.0-1008.8UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1058.61~22.04.1UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-oracle-7.07.0.0-1011.11~24.04.1UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-raspi5.15.0-1106.109UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-raspi6.8.0-1061.65UBUNTU-CVE-2026-53003
Ubuntu:25.10linux-raspino fix listedUBUNTU-CVE-2026-53003
Ubuntu:26.04:LTSlinux-raspi7.0.0-1015.15UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-53003
Ubuntu:25.10linux-realtimeno fix listedUBUNTU-CVE-2026-53003
Ubuntu:26.04:LTSlinux-realtime7.0.0-28.28.1UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-53003
Ubuntu:25.10linux-riscvno fix listedUBUNTU-CVE-2026-53003
Ubuntu:26.04:LTSlinux-riscv7.0.0-28.28.1UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-136.136~22.04.3UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-riscv-7.07.0.0-28.28.1~24.04.3UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-vmware6.8.0-1008.8UBUNTU-CVE-2026-53003
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1033.34UBUNTU-CVE-2026-53003
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1075.79UBUNTU-CVE-2026-53003

Affected products (as reported)

VendorProductVersions
Linux Linux 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 – before cb3beef35ab5e0c1afca9fd7648c6ae4997863777fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 – before ba758fdf1399f310b30098b6faa3fd043de47dd27fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 – before fcca1df05322bb04e344dd1178b54b76a08eb7c37fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 – before 8a5e840babc5c0fbd10c73728a13192347771ec67fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 – before 49e41b60ccd1bdbe9e218420f716dd5f9a2f9c717fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 – before 0cab5d077dd1efd2bd1a47271acc35894f945b4f7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 – before 2b5c3c040d020e3ab3b9a8887031202d96843b1e7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 – before cc1ff87bce1ccd38410ab10960f576dcd17db679
Linux Linux 5.0

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References