CVE-2026-102726

Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read...

EUVD-2026-89193

Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read...

CVE-2026-102726

The NetX Duo software (referenced via GHSA-2wwp-ffgp-6ggj ) is vulnerable to a worker stall and an out-of-bounds read due to unbounded PPP IPCP Option Parsing . This issue impacts the availability of the system, as indicated by the CVSS metrics. No specific exploit details or remediation versions...

CVE-2026-102726

Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read...

PT-2026-102792

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An issue exists where unbounded PPP IPCP option parsing leads to a worker stall and an out-of-bounds read. PPP Point-to-Point Protocol IPCP Internet Protocol...

CVE-2026-102726: Out-of-bounds Read

Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read...

CVE-2026-97964

In the Linux kernel, the following vulnerability has been resolved: pppsynctty: ensure a writeable skb header pppsynctxmunge checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP...

DEBIAN-CVE-2026-97964

In the Linux kernel, the following vulnerability has been resolved: pppsynctty: ensure a writeable skb header pppsynctxmunge checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP...

UBUNTU-CVE-2026-97964

In the Linux kernel, the following vulnerability has been resolved: pppsynctty: ensure a writeable skb header pppsynctxmunge checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP...

EUVD-2026-86818

In the Linux kernel, the following vulnerability has been resolved: pppsynctty: ensure a writeable skb header pppsynctxmunge checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP...

CVE-2026-97964 ppp_synctty: ensure a writeable skb header

In the Linux kernel, the following vulnerability has been resolved: pppsynctty: ensure a writeable skb header pppsynctxmunge checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP...

CVE-2026-97964 ppp_synctty: ensure a writeable skb header

In the Linux kernel, the following vulnerability has been resolved: pppsynctty: ensure a writeable skb header pppsynctxmunge checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP...

PT-2026-98820

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ppp async component where the process input packet function incorrectly resets a reused socket buffer skb headroom to zero during a frame-error path. This violates...

Linux Distros Unpatched Vulnerability : CVE-2026-97964

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pppsynctty: ensure a writeable skb header pppsynctxmunge checks headroom before prepending the address and control bytes, but does not ensure that the skb heade...

PT-2026-98628

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ppp sync txmunge function where it fails to ensure that the skb socket buffer header is writable before prepending address and control bytes. When a received skb...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: ppp: Deferring the freeing of channels to an RCU callback via callrcu ensures that any ongoing pppol2tprecv operations are protected during the grace period. This prevents unexpected dereferencing of channels that were just...

CVE-2026-75131

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote...

CVE-2026-75131 NetworkManager-l2tp Privilege Escalation via pppd Username Injection

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote...

CVE-2026-75131

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote...

Linux Distros Unpatched Vulnerability : CVE-2026-85495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - ppp - None Ubuntu Linux - pre-authentication global buffer overflow CVE-2026-85495 Note that Nessus relies on the presence of the package as...