CVE-2026-75883: PPP Daemon Buffer Overflow Vulnerability

CVE-2026-75883 Overview

CVE-2026-75883 is a heap buffer overflow [CWE-122] in the Point-to-Point Protocol daemon (pppd) from the ppp-project. The peap_response() function copies an entire Transport Layer Security (TLS) record of up to 16384 bytes into the fixed global buffer outpacket_buf. The function performs no bounds check and does not implement outgoing Protected Extensible Authentication Protocol (PEAP) fragmentation. A malicious PEAP server can corrupt global static data adjacent to outpacket_buf, causing incorrect behavior or a process crash.

Critical Impact
A hostile or compromised PEAP authentication server can corrupt pppd memory, leading to denial of service and potential integrity compromise of the daemon process.

Affected Products

ppp-project/ppp — pppd daemon with PEAP authentication support
Distributions bundling the affected pppd build with PEAP enabled
Systems configured to connect to untrusted PEAP authentication servers

Discovery Timeline

2026-09-18 - CVE-2026-75883 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-75883

Vulnerability Analysis

The flaw lives in the PEAP response handler in pppd. When the daemon receives a PEAP Request packet, peap_response() builds a reply that embeds a TLS record. The implementation copies the full record, up to the 16384-byte TLS maximum, directly into outpacket_buf, a fixed-size global buffer.

Because the function neither validates the destination capacity nor fragments the outgoing PEAP payload across multiple EAP messages, oversized records overflow the buffer. The overflow overwrites adjacent global static data in the pppd process image. The result is memory corruption that typically manifests as a crash but may cause incorrect authentication behavior depending on which globals sit after outpacket_buf in the linker layout.

Exploitation requires the victim pppd process to initiate or accept a PEAP-authenticated session with an attacker-controlled server. The attacker responds with a crafted TLS record sized to overflow the buffer.

Root Cause

The root cause is missing bounds checking combined with absent outgoing PEAP fragmentation logic. peap_response() assumes the TLS record will fit in outpacket_buf, but the TLS specification permits records up to 16384 bytes, exceeding the buffer's fixed capacity.

Attack Vector

The attack vector is adjacent network. An attacker must control or impersonate a PEAP server that the target pppd client connects to. No authentication or user interaction is required from the victim. Once the PEAP handshake starts, the attacker supplies an oversized TLS record to trigger the overflow. See the GitHub Security Advisory GHSA-rwr9-4vx8-vc35 for upstream technical details.

Detection Methods for CVE-2026-75883

Indicators of Compromise

Unexpected crashes or restarts of the pppd process on systems using PEAP authentication
Core dumps referencing peap_response() or corruption near the outpacket_buf symbol
PPP session failures immediately following the PEAP TLS handshake phase
Connections from pppd clients to unknown or unauthorized PEAP authentication servers

Detection Strategies

Monitor host telemetry for abnormal termination of pppd and correlate with recent PPP or PEAP session activity
Inspect authentication logs for repeated PEAP failures preceded by unusually large EAP-TLS payloads
Use network sensors to flag EAP-TLS records approaching 16384 bytes destined for pppd clients

Monitoring Recommendations

Enable verbose pppd logging during PEAP negotiation to capture record sizes and peer identities
Track outbound PPP connections to identify sessions established with unexpected PEAP servers
Forward pppd crash artifacts and syslog events to a centralized SIEM for correlation across hosts

How to Mitigate CVE-2026-75883

Immediate Actions Required

Restrict pppd clients to trusted PEAP authentication servers using configuration allowlists
Disable PEAP authentication in pppd where alternative EAP methods are acceptable
Apply the upstream ppp-project patch referenced in the security advisory as soon as it is available in your distribution

Patch Information

Refer to the ppp-project security advisory GHSA-rwr9-4vx8-vc35 for patch commits and fixed versions. Rebuild or upgrade pppd packages once vendors publish updated builds that add bounds checking and outgoing PEAP fragmentation in peap_response().

Workarounds

Configure pppd to reject PEAP by removing PEAP from the permitted EAP method list
Enforce network segmentation so pppd clients can only reach vetted RADIUS or PEAP infrastructure
Run pppd under a service manager that isolates crashes and prevents cascading failures

bash

# Configuration example: disable PEAP by restricting EAP methods in /etc/ppp/eap-secrets
# and ensure only known-good servers are trusted
refuse-eap
require-mschap-v2