CVE-2026-58096: ppp(8): missing length validation in LcpDecodeConfig()
LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write.
A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate exploitation by preventing/limiting PPP connections from untrusted peers until the fix for CVE-2026-58095/CVE-2026-58096 is applied (e.g., restrict which remote systems can establish PPP sessions via firewall/ACL).
- Operational
After applying the vendor fix for CVE-2026-58095/CVE-2026-58096, restart/restart the ppp(8) service to ensure the updated LcpDecodeConfig() code path is used.
Event History
Frequently Asked Questions
Who can exploit this issue?
A malicious PPP peer can send an undersized endpoint discriminator option during PPP negotiation. The supplied CVSS vector indicates the attack is network-accessible, requires no privileges, and requires no user interaction.
What is the likely impact of successful exploitation?
The out-of-bounds write can crash ppp(8). The description also states that, when combined with CVE-2026-58095, it may allow arbitrary code execution as root.
Does exploitation require another vulnerability for code execution?
The provided information specifically describes arbitrary root code execution as possible through exploitation of both CVE-2026-58095 and CVE-2026-58096. This issue alone is stated to cause an out-of-bounds write and can crash ppp(8).