CVE-2026-93337: NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection
NetworkManager-l2tp contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit the verbatim write of unvalidated strings into the pppd options file via writeconfigoption() to inject the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object and achieve arbitrary code execution as root.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user who has permission to create VPN connections can exploit it. Exploitation requires that the user can supply crafted mru or mtu property values.
What access does successful exploitation provide?
Successful exploitation can cause the privileged pppd process to load an attacker-controlled shared object. This results in arbitrary code execution as root.
What input is used to trigger the injection?
The attacker supplies an mru or mtu value consisting of a valid integer followed by non-numeric trailing content. That content is written verbatim into the pppd options file and can inject a pppd plugin directive.
How can I determine whether a system may be exposed?
A system may be exposed if it uses NetworkManager-l2tp and allows local users to create VPN connections. Review whether such users can set mru or mtu properties for those connections.