CVE-2026-53003

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

pppoe: drop PFC frames

RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT

RECOMMENDED for PPPoE. In practice, pppd does not support negotiating

PFC for PPPoE sessions, and the current PPPoE driver assumes an

uncompressed (2-byte) protocol field. However, the generic PPP layer

function ppp_input() is not aware of the negotiation result, and still

accepts PFC frames.

If a peer with a broken implementation or an attacker sends a frame with

a compressed (1-byte) protocol field, the subsequent PPP payload is

shifted by one byte. This causes the network header to be 4-byte

misaligned, which may trigger unaligned access exceptions on some

architectures.

To reduce the attack surface, drop PPPoE PFC frames. Introduce

ppp_skb_is_compressed_proto() helper function to be used in both

ppp_generic.c and pppoe.c to avoid open-coding.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References