CVE-2026-58097: ppp(8): missing length validation in mp_SetEnddisc()
mpSetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface.
A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user who has access to the ppp(8) command interface can supply a crafted PSN endpoint value. Remote exploitation is not described in the available information.
What level of impact could successful exploitation have?
An attacker may crash ppp(8), causing a denial of service. The vulnerability could also potentially allow arbitrary code execution as root.
How can I determine whether a system is exposed?
Exposure depends on whether local users can access the ppp(8) command interface and can provide PSN endpoint values to it. The supplied information does not identify affected versions or configuration-specific indicators.