Bug 2538087 (CVE-2026-93337)

Summary: CVE-2026-93337 NetworkManager-l2tp: NetworkManager-l2tp: Privilege Escalation via pppd Plugin Injection
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in NetworkManager-l2tp. This improper input validation vulnerability allows local users with permissions to create VPN connections to inject arbitrary directives into the `pppd` (Point-to-Point Protocol Daemon) options file. By supplying specially crafted `mru` or `mtu` property values, an attacker can cause the privileged `pppd` process to load a malicious shared object. This can lead to arbitrary code execution with root privileges.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2539348, 2539349    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-22 17:04:06 UTC 
NetworkManager-l2tp contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit the verbatim write of unvalidated strings into the pppd options file via write_config_option() to inject the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object and achieve arbitrary code execution as root.