CVE-2026-75131: NetworkManager-l2tp Privilege Escalation

CVE-2026-75131 Overview

CVE-2026-75131 is a local privilege escalation vulnerability in NetworkManager-l2tp through version 1.52.4, fixed in 1.52.6. The flaw allows local users with permission to create VPN connections to execute arbitrary code as root. Attackers inject pppd options through a crafted VPN username field. By embedding a double-quote character or whitespace in the username, an attacker breaks out of the pppd options file quoting context. This enables injection of the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object. The issue is classified under [CWE-88] (Argument Injection).

Critical Impact
A local user authorized to create VPN connections can escalate to root by loading an arbitrary shared library into the privileged pppd process.

Affected Products

NetworkManager-l2tp versions up to and including 1.52.4
Linux distributions packaging NetworkManager-l2tp with L2TP/IPsec VPN support
Fixed in NetworkManager-l2tp 1.52.6

Discovery Timeline

2026-09-23 - CVE-2026-75131 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-75131

Vulnerability Analysis

NetworkManager-l2tp writes VPN connection parameters into a pppd options file that is subsequently consumed by the privileged pppd daemon. The username supplied through the VPN connection profile is embedded into this options file inside double-quoted strings. The application fails to sanitize or escape special characters such as double quotes and whitespace before writing the username into the file.

An attacker who can create a VPN connection profile crafts a username containing a double-quote or whitespace character. This terminates the quoted string prematurely and appends attacker-controlled directives to the options file. The plugin directive is particularly dangerous because pppd loads the specified shared object into its address space and executes code from it.

Because pppd runs with elevated privileges to configure network interfaces and routing, the loaded plugin executes as root. This grants the attacker full control of the host from a low-privileged position that only requires the ability to define VPN profiles.

Root Cause

The root cause is improper neutralization of argument delimiters in the username field written to the pppd options file. The code assumes double-quoting is sufficient to safely embed user-supplied strings. It does not escape embedded double quotes or reject whitespace, allowing argument injection consistent with [CWE-88].

Attack Vector

Exploitation requires local access with permission to create NetworkManager VPN connections. The attacker creates an L2TP VPN profile with a malicious username containing a double-quote followed by the plugin directive pointing to an attacker-controlled .so file. When the VPN connection is initiated, pppd parses the injected directive and loads the shared object, executing attacker code as root.

See the GitHub Security Advisory and VulnCheck Privilege Escalation Advisory for full technical detail.

Detection Methods for CVE-2026-75131

Indicators of Compromise

Unexpected shared object files referenced by pppd plugin directives in /var/run/nm-l2tp-* or /tmp paths
NetworkManager VPN connection profiles with unusual characters (double quotes, spaces) in the user field
pppd processes loading shared libraries from non-standard directories such as user-writable paths
New or modified .so files created by unprivileged users shortly before VPN connection attempts

Detection Strategies

Inspect NetworkManager connection files under /etc/NetworkManager/system-connections/ for L2TP profiles with quote or whitespace characters in the username field.
Monitor pppd invocations and parse generated options files for plugin directives that were not authored by administrators.
Correlate low-privileged user activity with root-level process creation events immediately following VPN connection initiation.

Monitoring Recommendations

Enable auditd rules on execve for /usr/sbin/pppd and on open for files matching nm-l2tp-*.
Alert on dlopen or shared library loads by pppd originating from user-writable directories.
Track creation of NetworkManager VPN profiles by non-administrative accounts and flag those containing special characters.

How to Mitigate CVE-2026-75131

Immediate Actions Required

Upgrade NetworkManager-l2tp to version 1.52.6 or later on all affected Linux systems.
Audit existing NetworkManager L2TP VPN profiles for suspicious usernames containing quotes or whitespace.
Restrict which users are granted PolicyKit authorization to create or modify system VPN connections.
Review recent pppd process activity for unexpected plugin loads that may indicate prior exploitation.

Patch Information

The vulnerability is fixed in NetworkManager-l2tp 1.52.6. Distribution maintainers have released backported patches; apply vendor updates as they become available through your package manager. Refer to the upstream GitHub Security Advisory GHSA-v2wj-xr2m-xc4j for patch details.

Workarounds

Remove or disable the NetworkManager-l2tp plugin package if L2TP VPN functionality is not required.
Tighten PolicyKit rules so only administrators can invoke org.freedesktop.NetworkManager.settings.modify.system for VPN connections.
Enforce SELinux or AppArmor profiles that restrict pppd from loading shared objects outside trusted system directories.

bash

# Configuration example: restrict VPN connection creation via PolicyKit
# /etc/polkit-1/rules.d/50-restrict-nm-vpn.rules
polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.NetworkManager.settings.modify.system" &&
        !subject.isInGroup("wheel")) {
        return polkit.Result.NO;
    }
});