CVE-2026-43080
Buffer Overflow in Linux Kernel L2TP
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's l2tp (Layer 2 Tunneling Protocol) implementation with UDP encapsulation. It involves an overflow of the 16-bit UDP length field when sending oversized PPPoL2TP packets. Specifically, the function l2tp_xmit_core does not properly check for overflow when assigning the UDP length field, causing the length value to be trimmed to 16 bits. This can lead to incorrect packet handling.
The issue was discovered when syzbot triggered a warning due to an overflow check added in a patch series. The vulnerability allows sending an oversized packet (e.g., 0x34000 bytes) which exceeds the maximum UDP length field size, causing the overflow.
The fix involves adding an overflow check that drops oversized packets to prevent sending packets with a trimmed UDP length to the network.
How can this vulnerability impact me? :
This vulnerability can impact systems running the affected Linux kernel by allowing malformed or oversized PPPoL2TP packets to be processed incorrectly due to the UDP length field overflow. This could potentially lead to unexpected behavior such as kernel warnings, instability, or denial of service conditions if the kernel mishandles these packets.
Since the UDP length field overflow causes the length to be trimmed, it may result in corrupted packet processing or dropped packets, which could disrupt network communications relying on L2TP over UDP.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for kernel warnings related to UDP length field overflow in the l2tp module. Specifically, the debug WARN added in the patch triggers a warning when oversized PPPoL2TP packets with UDP encapsulation are processed.
One way to detect this is to check the kernel logs for warnings similar to the following message: "WARNING: ./include/linux/udp.h:38 at udp_set_len_short include/linux/udp.h:38 [inline], CPU#X: syz.YY/ZZZZ" which indicates an overflow condition.
To actively test or reproduce the issue, the syzbot repro commands involve creating PPPoL2TP and UDP sockets and sending an oversized packet. While these are not typical detection commands, they illustrate the nature of the problematic packets.
For practical detection on your system, you can use the following commands:
- Check kernel logs for warnings: sudo dmesg | grep -i 'udp_set_len_short\|l2tp_xmit_core\|WARNING'
- Monitor for unusual large UDP packets encapsulated in L2TP using packet capture tools like tcpdump: sudo tcpdump -n -vvv udp and filter for large packet sizes or L2TP traffic.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to apply the patch that adds an overflow check to drop oversized PPPoL2TP packets with UDP encapsulation, preventing the UDP length field overflow.
Until the patch is applied, you can mitigate risk by restricting or filtering large UDP packets encapsulated in L2TP on your network, for example by using firewall rules to block suspicious oversized packets.
Additionally, monitoring kernel logs for the debug WARN messages can help identify if the vulnerability is being triggered.