CVE-2026-43080: Linux Kernel L2TP DoS Vulnerability

CVE-2026-43080 Overview

CVE-2026-43080 is a Linux kernel vulnerability in the Layer 2 Tunneling Protocol (L2TP) subsystem. The flaw resides in l2tp_xmit_core within net/l2tp/l2tp_core.c, where oversized PPP-over-L2TP packets with UDP encapsulation cause a 16-bit UDP length field overflow. When a userspace process transmits a packet exceeding 65,535 bytes through an L2TP socket, the kernel assigns the truncated length to the UDP header without bounds checking. The issue was discovered through syzbot fuzzing and has been resolved upstream by adding an overflow check that drops oversized packets before they reach the wire.

Critical Impact

Local users can trigger kernel warnings and produce malformed UDP packets, leading to potential denial of service and protocol corruption on systems running L2TP tunnels.

Affected Products

• Linux kernel versions containing the L2TP UDP encapsulation code path in net/l2tp/l2tp_core.c
• Systems using PPPoL2TP sockets with IPv4 or IPv6 UDP encapsulation
• Distributions shipping kernels prior to the upstream fix commits

Discovery Timeline

• 2026-05-06 - CVE-2026-43080 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43080

Vulnerability Analysis

The vulnerability is an integer truncation flaw in the Linux kernel L2TP transmit path. When l2tp_xmit_core constructs an outbound L2TP packet with UDP encapsulation, it computes the total packet length and assigns the value to the UDP header's 16-bit len field. The kernel did not validate that the computed length fit within 16 bits.

A syzbot reproducer demonstrates the issue by opening a PPPoL2TP socket, connecting it to an IPv6 UDP socket, and issuing a writev syscall with a 0x34000-byte (212,992 byte) payload. The payload exceeds the UDP length field's maximum value of 65,535. The kernel silently truncates the value, producing UDP packets with corrupted length headers that get transmitted on the wire.

The upstream fix adds a length validation check in l2tp_xmit_core that drops packets exceeding the 16-bit UDP length boundary, preventing the truncation and the subsequent transmission of malformed packets.

Root Cause

The root cause is missing boundary validation when assigning a wider integer value to a 16-bit field [Numeric Truncation Error]. The L2TP transmit logic in net/l2tp/l2tp_core.c accepted packet lengths from userspace via writev, sendmsg, and related socket interfaces without enforcing the UDP protocol's 65,535-byte maximum before writing to udp_set_len_short in include/linux/udp.h:38.

Attack Vector

A local unprivileged user with the ability to create a PPPoL2TP socket can trigger the condition. The user opens an L2TP socket, connects it through an underlying UDP socket, and writes a payload larger than 65,535 bytes. The kernel proceeds to construct a UDP packet with a truncated length field, generating a kernel warning on instrumented kernels and emitting protocol-violating traffic on production kernels.

The vulnerability is described in prose only; refer to the upstream commits for the exact patch logic and reproducer details available in the kernel mailing list discussion.

Detection Methods for CVE-2026-43080

Indicators of Compromise

• Kernel log entries containing WARNING references to udp_set_len_short or l2tp_xmit_core with messages such as len >= 65536u
• Unexpected kernel stack traces originating from pppol2tp_sendmsg followed by sock_write_iter and vfs_writev
• Malformed UDP packets on L2TP tunnel interfaces showing length field values inconsistent with actual payload size

Detection Strategies

• Monitor dmesg and /var/log/kern.log for warnings emitted from net/l2tp/l2tp_core.c line 1293 or 1327
• Audit processes invoking socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP) followed by large writev or sendmsg calls
• Use packet capture on L2TP-bearing interfaces to identify UDP datagrams whose declared length is smaller than the on-wire payload

Monitoring Recommendations

• Enable kernel auditing for L2TP socket creation events and correlate them with subsequent oversized write syscalls
• Track which kernel build is deployed across the fleet and flag hosts running pre-patch versions referenced in the upstream commits 77c1489, 86534c9, 9ccce02, ebe560e, and f295fe8
• Forward kernel ring buffer warnings to a centralized log platform for long-term retention and anomaly detection

How to Mitigate CVE-2026-43080

Immediate Actions Required

• Apply the upstream Linux kernel patches that introduce the overflow check in l2tp_xmit_core and rebuild or update affected kernels
• Restrict the ability to create L2TP sockets to trusted system services where feasible by using namespaces or seccomp filters
• Audit running systems for active L2TP tunnels and confirm whether the host runs a patched kernel build

Patch Information

The fix has been merged into the mainline and stable Linux kernel trees. Reference the following upstream commits: Kernel Git Commit 77c1489, Kernel Git Commit 86534c9, Kernel Git Commit 9ccce02, Kernel Git Commit ebe560e, and Kernel Git Commit f295fe8. Distribution maintainers ship these fixes through standard kernel package updates.

Workarounds

• Disable the l2tp_ppp and l2tp_core kernel modules on hosts that do not require L2TP functionality using modprobe -r and a blacklist entry in /etc/modprobe.d/
• Apply seccomp or AppArmor profiles that prevent untrusted processes from invoking the socket syscall with AF_PPPOX
• Limit the maximum write size on L2TP sockets at the application layer where the kernel cannot yet be patched

# Configuration example
# Blacklist L2TP modules until the kernel is patched
echo 'blacklist l2tp_ppp' | sudo tee /etc/modprobe.d/disable-l2tp.conf
echo 'blacklist l2tp_core' | sudo tee -a /etc/modprobe.d/disable-l2tp.conf
sudo modprobe -r l2tp_ppp l2tp_core

# Verify modules are unloaded
lsmod | grep -E 'l2tp_(ppp|core)'