CVE-2026-58097 ppp(8): missing length validation in mp_SetEnddisc()

mpSetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

CVE-2026-58097 ppp(8): missing length validation in mp_SetEnddisc()

FreeBSD ppp(8) is a user-space Point-to-Point Protocol implementation installed setuid root . This vulnerability resides in mp_SetEnddisc() , a function handling Multilink PPP endpoint discriminators. The root cause is that a user-supplied PSN endpoint value is copied into a buffer without length...