CVE-2026-53003 pppoe: drop PFC frames
An attacker can cause a denial of service by sending malformed PPPoE frames with compressed protocol fields, triggering unaligned access exceptions in the Linux kernel.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53003?
CVE-2026-53003 is a high-severity denial of service vulnerability in Linux kernel, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
pppoe: drop PFC frames
RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the current PPPoE driver assumes an uncompressed (2-byte) protocol field. However, the generic PPP layer function ppp_input() is not aware of the negotiation result, and still accepts PFC frames.
If a peer with a broken implementation or an attacker sends a frame with a compressed (1-byte) protocol field, the subsequent PPP payload is shifted by one byte. This causes the network header to be 4-byte misaligned, which may trigger unaligned access exceptions on some architectures.
To reduce the attack surface, drop PPPoE PFC frames. Introduce ppp_skb_is_compressed_proto() helper function to be used in both ppp_generic.c and pppoe.c to avoid open-coding.
Weakness: CWE-20
Which versions are affected by CVE-2026-53003?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53003?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-53003 being exploited?
There is no known exploitation of CVE-2026-53003 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53003, DEBIAN-CVE-2026-53003, GHSA-7g5v-54rw-hq9g, ROOT-OS-DEBIAN-11-CVE-2026-53003, ROOT-OS-DEBIAN-12-CVE-2026-53003, ROOT-OS-UBUNTU-2204-CVE-2026-53003 and 2 more.