CVE-2026-46306: Linux Kernel PPPoE Flow Dissector Denial-of-Service

Technical summary

The vulnerability exists in the Linux kernel's flow dissector logic, which classifies network traffic for steering and hashing. RFC 2516 specifies that Protocol Field Compression (PFC) is not recommended for PPPoE frames; the compressed protocol field uses one byte instead of two, shifting the PPP payload and creating a 4-byte alignment mismatch in the network header. When the dissector processes a PFC-compressed PPPoE frame, it reads from a misaligned memory address, causing an unaligned access exception (__skb_flow_dissect function). On architectures with strict alignment requirements (MIPS, ARM, others), this results in a kernel panic. The crash is reachable via RPS processing of incoming frames, requiring no active PPPoE session or privileged access.

Business impact

This is a denial-of-service vulnerability that can be exploited remotely to crash Linux systems handling PPPoE traffic. Even systems not using PPPoE can be affected if RPS is enabled (a common optimization on multi-CPU systems). Production environments relying on high availability—particularly ISPs, VPN gateways, and edge routers—face unexpected downtime. The low barrier to exploitation (unauthenticated remote trigger) and wide potential blast radius make this a significant operational risk for kernel maintainers and distributions.

Affected systems

All Linux kernel versions containing the flow dissector's PPPoE handling are potentially affected. The kernel's strict alignment rules apply most critically on MIPS, ARM, PowerPC, and other RISC architectures; x86/x64 systems tolerate misaligned access but still exhibit undefined behavior. Systems with RPS enabled (default on modern multi-core deployments) are directly vulnerable; single-core or RPS-disabled systems have reduced attack surface. The fix requires a kernel patch; no userspace workaround exists.

Exploitability

Exploitation requires only network access to send a single malformed PPPoE frame to any reachable ethernet interface. No authentication, user interaction, or special privileges are needed. An attacker on the same network segment or with IP-level routing access can trigger the crash. The RPS processing path is executed in the packet receive interrupt handler, bypassing most userspace security boundaries. Weaponization is straightforward: a simple packet crafting tool can generate and transmit the offending frame.

Remediation

Update the Linux kernel to a patched version that skips processing of PPPoE frames with Protocol Field Compression enabled. The fix modifies the flow dissector to explicitly reject or ignore compressed PPPoE frames, eliminating the alignment violation. Verify the patch version against your vendor's kernel advisory (verify against the vendor advisory for specific version numbers). As an interim mitigation on systems unable to patch immediately, disable RPS via the `rps_cpus` sysfs knob or restrict network access to trusted sources only; neither fully eliminates the risk.

Patch guidance

Coordinate with your Linux distribution for a patched kernel release targeting this CVE. Kernel maintainers have developed a straightforward fix that prevents dissection of PFC-marked PPPoE frames. Test patched kernels in a staging environment before production deployment, as kernel updates require reboot. Monitor your vendor's security advisory for release timelines. Systems not yet offered a patched kernel should prioritize patching once available, especially edge routers and VPN gateways handling untrusted traffic.

Detection guidance

Monitor system logs for kernel panics or unaligned access exceptions originating from the flow dissector (`__skb_flow_dissect` in stack traces). Network-level detection is challenging without deep packet inspection; PPPoE PFC frames may not be distinguishable from normal traffic in standard logs. Enable kernel crash dumps (kdump) and preserve them for forensic analysis. On MIPS and ARM systems, elevated rates of CPU exceptions in the network receive path may signal exploitation attempts. Intrusion detection systems may struggle to detect this attack, as the payload is a single crafted packet with no obvious signature.

Why prioritize this

Although unpatched systems face direct denial-of-service risk, the attack requires network reachability and is non-persistent (single crash per packet). However, the ease of exploitation and the critical nature of kernel stability warrant prompt patching. Organizations running kernel versions on MIPS or ARM hardware, or with RPS-heavy traffic patterns, should prioritize this update highest. Systems in isolated networks or with RPS disabled can follow a standard patch schedule.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a remotely exploitable, unauthenticated denial-of-service with no user interaction required and high availability impact. The Attack Vector is Network, Attack Complexity is Low, no authentication needed, no user interaction, and the scope is unchanged. Confidentiality and integrity are not affected, but availability is completely compromised for the affected system. The score does not account for mitigation of attack surface (RPS-disabled systems, isolated networks) or the non-persistent nature of the crash; organizations should contextualize this within their infrastructure topology.

Frequently asked questions