CVE-2026-43080

A flaw was found in the Linux kernel's L2TP (Layer 2 Tunneling Protocol) subsystem. This vulnerability allows a remote attacker to send an oversized PPPoL2TP packet with UDP encapsulation. Due to an overflow in the 16-bit UDP length field, the packet's length is incorrectly truncated, which can lead to unexpected network behavior or a denial of service.

This vulnerability is rated as Moderate severity because exploitation requires local access with the ability to create PPPoL2TP sockets, limiting the blast radius to localized network transmission errors or denial of service without compromising confidentiality or system integrity. In default Red Hat Enterprise Linux installations, L2TP tunneling is not active unless explicitly configured for VPN or network encapsulation scenarios. Systems actively utilizing UDP-encapsulated L2TP tunnels could encounter kernel warning messages or corrupted packet transmissions when handling truncated datagram lengths.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.