CVE-2026-58096

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

CVE-2026-58096

The ppp(8) utility in the FreeBSD operating system kernel contains a memory safety vulnerability in the LcpDecodeConfig() function. The flaw exists because the function fails to validate the length of received endpoint discriminator options against the minimum requirements specified in RFC 1717 ,...

CVE-2026-58096 ppp(8): missing length validation in LcpDecodeConfig()

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

CVE-2026-58095 ppp(8): incorrect length calculation in mp_Enddisc()

mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58095 ppp(8): incorrect length calculation in mp_Enddisc()

mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58095

mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58095

The FreeBSD operating system is vulnerable to a buffer overflow in the ppp(8) utility due to incorrect length calculations within the mp_Enddisc() function. When formatting endpoint discriminator addresses for display, a received endpoint option can overflow a global result buffer. A malicious PP...

PT-2026-81940

mp SetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

PT-2026-81938

mp Enddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58095: Heap-based Buffer Overflow

mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp8 or potentially execute arbitrary code as root...

PT-2026-81939

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

CVE-2026-58097: Improper Handling of Length Parameter Inconsistency

mpSetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58096: Improper Handling of Length Parameter Inconsistency

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

FreeBSD : FreeBSD -- Multiple vulnerabilities in ppp(8) (204af099-a0ff-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 204af099-a0ff-11f1-ae1f-bc241121aa0a advisory. ppp8 contained three memory safety errors in its handling of multilink endpoint discriminator...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: tcpdump (UTSA-2026-093168)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093168 advisory. The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. Tenable has extracted the preceding description block directly from the...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098940)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098940 advisory. In the Linux kernel, the following vulnerability has been resolved: slip: reject VJ receive packets on instances with no rstate array slhcinit accepts rslots == 0 a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098901)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098901 advisory. In the Linux kernel, the following vulnerability has been resolved: hdlcppp: sync per-proto timers before freeing hdlc state Each PPP control protocol LCP/IPCP/IPV6...

FreeBSD Security Advisory - FreeBSD-SA-26:60.ppp

FreeBSD Security Advisory - ppp8 contained three memory safety errors in its handling of multilink endpoint discriminator options. mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global...

The vulnerability of the ppp_send_frame() function in the drivers/net/ppp/ppp_generic.c module of the Point-to-Point PPP protocol driver in the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the pppsendframe function in the drivers/net/ppp/pppgeneric.c module of the Point-to-Point PPP protocol driver in the Linux operating system is related to the lack of resource initialization. Exploiting this vulnerability can allow an attacker to cause a service failure...

FreeBSD-SA-26:60.ppp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:60.ppp Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities in ppp8 Category: core Module: ppp Announced: 2026-08-25 Credits: Robert Morris...