Executive brief
A vulnerability in the Linux kernel's network traffic processing could allow a remote attacker to crash certain systems, particularly those using MIPS architecture. By sending specially crafted network packets (PPPoE PFC frames), an attacker can trigger a system exception that leads to a denial of service. This affects systems even if they are not actively using the specific networking protocol involved.
Technical details
A vulnerability exists in the Linux kernel's flow_dissector component due to improper handling of PPPoE Protocol Field Compression (PFC) frames. When a compressed 1-byte protocol field is encountered, the subsequent PPP payload is shifted by one byte, causing a 4-byte misalignment for the network header. On architectures that do not support unaligned access, such as MIPS, this triggers an unaligned access exception (ExcCode 04) during flow dissection (e.g., when RPS is enabled). An attacker can trigger this remotely by sending a PPPoE PFC frame to an Ethernet interface. The fix involves disabling the dissection of PFC frames to maintain alignment and reduce attack surface.
Affected products
- Linux Linux Kernel Fixed in 6.1.x, 6.6.x, 6.8.x, 6.9.x and other stable branches
Timeline
- 2026-04-15: patched: Initial patch submitted by Qingfang Deng
- 2026-06-08: advisory: CVE-2026-46306 published
References
- https://git.kernel.org/stable/c/0d00b9015069712944934bab09eaa6c542143049
- https://git.kernel.org/stable/c/18ae9eacfc95cc715c0606b2c86e8aa8a86cf3e3
- https://git.kernel.org/stable/c/6044392d9cace3a3672b02c8bc7d38b502e51734
- https://git.kernel.org/stable/c/7c93f353eab4ea911e394630f07d72e040a729d8
- https://git.kernel.org/stable/c/abc5bc84e0f2edc7ea2d437afa6ef3fe1fc43200
- https://git.kernel.org/stable/c/d6c19b31a3c1d519fabdcf0aa239e6b6109b9473
- https://git.kernel.org/stable/c/db104b0d8a7856397c0469d83a4289adf7c54863