src/nm-l2tp-service.c writes attacker-controlled vpn.data values (ipsec-ike, ipsec-esp, ipsec-group-name -> leftid, ipsec-remote-id -> rightid) into the generated /run/nm-l2tp-<uuid>/ipsec.conf with no escaping: validate_one_property() only content-checks the gateway, and write_config_option() writes the value raw.

A newline in those values injects arbitrary ipsec.conf lines into a file pluto loads as root. An injected leftupdown=<cmd> is run by pluto as root on SA establishment, resulting in local privilege escalation.

Any unprivileged local user with a local login session can AddConnection+ActivateConnection an "own" L2TP profile (polkit settings.modify.own + network-control, no admin/wheel required) and obtain root code execution. This is the same bug class as CVE-2018-10900 (NetworkManager-vpnc); the libreswan and vpnc plugins already reject newlines in these values, l2tp did not.

On default SELinux-enforcing Fedora/RHEL systems the executed code runs as uid=0 but confined to ipsec_mgmt_t (a system-binary leftupdown is required there); on non-SELinux systems it is unconfined root.

Reported via coordinated disclosure by Keith Linneman (keith). Upstream maintainer Doug fixed the issue by rejecting control characters in vpn.data/vpn.secrets string values before writing config (and similarly for env variables), released in NetworkManager-l2tp 1.52.4 (EPEL8: 1.20.24), and pushed updated packages to Fedora, EPEL, and Debian on 2026-07-05.