Executive brief
A vulnerability in the Linux kernel's L2TP networking protocol could allow a local user to cause a system crash or instability. The issue occurs when the system processes network packets that are too large for the standard UDP format, leading to internal errors. This could be used by an attacker to disrupt services or perform a denial-of-service attack on the affected machine.
Technical details
An integer overflow vulnerability exists in the l2tp_xmit_core function within net/l2tp/l2tp_core.c of the Linux kernel. When transmitting PPPoL2TP packets with UDP encapsulation, the code fails to check if the combined length of the headers and data exceeds the 16-bit limit (65,535 bytes) of the UDP length field. An attacker with local access can trigger this by sending an oversized packet (e.g., 0x34000 bytes), causing the length value to be truncated and potentially triggering kernel warnings or undefined behavior. The fix introduces an explicit overflow check that drops packets exceeding U16_MAX.
Affected products
- Linux Linux Kernel 6.2 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-03: patched: Initial patch authored by Alice Mikityanska
- 2026-05-06: advisory: CVE-2026-43080 published
References
- https://git.kernel.org/stable/c/02d787fd0922c71c0264449fe82d35983613e4e5
- https://git.kernel.org/stable/c/77c1489398c85a844f90205f5e76fd6bc8bb4089
- https://git.kernel.org/stable/c/86534c97abd6365a9a021fd767a2023e63c44469
- https://git.kernel.org/stable/c/9ccce02d501335f59a02f26c878c5e095b16302f
- https://git.kernel.org/stable/c/a42452db035577e150ffd9adf98c56fef9fb9408
- https://git.kernel.org/stable/c/c2994fd24997ed63d713c03313f863645adb4d6c
- https://git.kernel.org/stable/c/ebe560ea5f54134279356703e73b7f867c89db13