Skip to content
Heist/ feed
Unrated

l2tp: Drop large packets with UDP encap

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: l2tp: Drop large packets with UDP encap syzbot reported a WARN on my patch series [1]. The actual issue is an overflow of 16-bit UDP length field, and it exists in the upstream code. My series added a debug WARN with an overflow check that exposed the issue, that's why syzbot tripped on my patches, rather than on upstream code. syzbot's repro: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0xfffffffc}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0xffff, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x32) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)="ee", 0x34000}], 0x1) It basically sends an oversized (0x34000 bytes) PPPoL2TP packet with UDP encapsulation, and l2tp_xmit_core doesn't check for overflows when it assigns the UDP length field. The value gets trimmed to 16 bites. Add an overflow check that drops oversized packets and avoids sending packets with trimmed UDP length to the wire. syzbot's stack trace (with my patch applied): len >= 65536u WARNING: ./include/linux/udp.h:38 at udp_set_len_short include/linux/udp.h:38 [inline], CPU#1: syz.0.17/5957 WARNING: ./include/linux/udp.h:38 at l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline], CPU#1: syz.0.17/5957 WARNING: ./include/linux/udp.h:38 at l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327, CPU#1:

Announced Source revision 1
Original source ↗

CVE-2026-43080

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-43080

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
        "lessThan": "02d787fd0922c71c0264449fe82d35983613e4e5",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
        "lessThan": "c2994fd24997ed63d713c03313f863645adb4d6c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
        "lessThan": "a42452db035577e150ffd9adf98c56fef9fb9408",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
        "lessThan": "9ccce02d501335f59a02f26c878c5e095b16302f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
        "lessThan": "77c1489398c85a844f90205f5e76fd6bc8bb4089",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
        "lessThan": "86534c97abd6365a9a021fd767a2023e63c44469",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
        "lessThan": "f295fe86e22ff0a2ecebf05e30a387e5cf6f6ddc",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
        "lessThan": "ebe560ea5f54134279356703e73b7f867c89db13",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/l2tp/l2tp_core.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2.6.23"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "2.6.23",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.258",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.209",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.175",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.136",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.83",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.24",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19.14",
        "versionType": "semver",
        "lessThanOrEqual": "6.19.*"
      },
      {
        "status": "unaffected",
        "version": "7.0",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/l2tp/l2tp_core.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-43080

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#28344 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement