CVE-2026-75131: NetworkManager-l2tp Privilege Escalation via pppd Username Injection
NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote character or whitespace in the username to break out of the pppd options file quoting context and include the pppd plugin directive, causing the privileged pppd process to load an attacker-controlled shared object.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NetworkManager-l2tpto a version that resolves this vulnerability.Fixed in 1.52.6
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A local user must have permission to create VPN connections. The issue can then be exploited by supplying a crafted VPN username.
What does an attacker need to do to gain root-level code execution?
The attacker injects a double quote or whitespace into the VPN username to escape the quoting context in the generated pppd options file. This can add a pppd plugin directive that loads an attacker-controlled shared object as root.
Which versions are affected and which version contains the fix?
NetworkManager-l2tp through version 1.52.4 is affected. The issue is fixed in version 1.52.6.