CVE-2026-53003: pppoe: drop PFC frames
In the Linux kernel, the following vulnerability has been resolved:
pppoe: drop PFC frames
RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the current PPPoE driver assumes an uncompressed (2-byte) protocol field. However, the generic PPP layer function pppinput() is not aware of the negotiation result, and still accepts PFC frames.
If a peer with a broken implementation or an attacker sends a frame with a compressed (1-byte) protocol field, the subsequent PPP payload is shifted by one byte. This causes the network header to be 4-byte misaligned, which may trigger unaligned access exceptions on some architectures.
To reduce the attack surface, drop PPPoE PFC frames. Introduce pppskbiscompressedproto() helper function to be used in both pppgeneric.c and pppoe.c to avoid open-coding.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Configuration
To reduce the attack surface, configure/patch PPPoE handling to drop PPPoE PFC frames, since PPPoE PFC is not accepted and can trigger misaligned network headers and unaligned access exceptions.
Linux kernel PPPoE drop PPPoE Protocol Field Compression (PFC) frames = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53003?
CVE-2026-53003 has a high severity rating of 7.5.
What is the risk associated with CVE-2026-53003?
The risk associated with CVE-2026-53003 is rated as 43.
How do I fix CVE-2026-53003?
The fix for CVE-2026-53003 involves updating to the latest version of the Linux kernel that resolves this vulnerability.
Which software is affected by CVE-2026-53003?
CVE-2026-53003 affects the Linux kernel and related systems managed by The Linux Foundation and Microsoft.
What does CVE-2026-53003 involve regarding PPPoE?
CVE-2026-53003 pertains to dropping Protocol Field Compression (PFC) frames in PPPoE sessions, as PFC is not recommended for use according to RFC 2516.