CVE-2026-46306

What it actually does

This is a Linux kernel denial-of-service flaw in the network flow dissector. A crafted PPPoE frame using Protocol Field Compression can shift the expected PPP payload by one byte, causing the flow dissector to parse a misaligned network header. On architectures that fault on unaligned memory access, such as some MIPS systems, this can trigger a kernel exception in packet receive processing and crash or destabilize the system. The issue can be reached by sending a malformed PPPoE PFC frame to an Ethernet interface, including cases where no active PPPoE session exists, particularly when Receive Packet Steering is enabled.

Why it matters to the business

An unauthenticated attacker with the ability to send crafted Ethernet/PPPoE traffic to an affected interface may be able to crash vulnerable Linux-based systems, causing network outages, service interruption, router or appliance reboots, and loss of availability. The risk is highest for embedded, edge, ISP, broadband, router, firewall, and appliance deployments using strict-alignment CPU architectures. This is not currently listed in CISA KEV, has no known mature public exploit in the supplied data, and has low EPSS, but the attack is simple where Layer 2 access to the target network segment is possible.

How an attack unfolds

An attacker first gains the ability to transmit raw Ethernet frames on the same Layer 2 segment as a vulnerable Linux network interface, such as a local LAN, broadband access segment, or other network path that forwards PPPoE session frames. The attacker crafts a PPPoE session packet that uses a compressed one-byte PPP protocol field even though PPPoE PFC is not normally negotiated or supported. When the target receives the frame, the kernel flow dissector attempts to parse it as if the PPP protocol field were in the expected layout. Because the compressed field shifts the subsequent payload by one byte, the dissector may perform an unaligned access while deriving packet flow information. On susceptible architectures and configurations, the unaligned access raises a kernel exception in functions such as __skb_flow_dissect, potentially causing a kernel panic, crash, or network stack failure.

How to fix it

Apply the Linux kernel fix that prevents the flow dissector from dissecting PPPoE Protocol Field Compression frames. Because no specific affected products or fixed versions were provided, use the relevant Linux distribution, appliance vendor, or kernel stable advisory to identify the corrected kernel package and upgrade to the first fixed release or later. For systems that cannot be patched immediately, reduce exposure by filtering unexpected PPPoE session traffic at network boundaries, limiting Layer 2 access to affected interfaces, disabling unnecessary PPPoE handling where possible, and considering disabling Receive Packet Steering on exposed interfaces if operationally acceptable. Edge devices, embedded Linux appliances, MIPS-based platforms, and broadband/ISP-facing equipment should be prioritized.

How to confirm the fix worked

Confirm the running kernel includes the upstream or vendor fix for PPPoE PFC handling in the flow dissector. Validate package status with the operating system vendor’s security advisory and compare the installed kernel build against the fixed release. On representative non-production hardware, send a crafted PPPoE PFC frame and confirm the system drops or ignores it without kernel warnings, oops output, reboot, or packet-processing failure. Check that Receive Packet Steering settings and interface exposure match the intended hardened configuration. Review kernel logs after validation for absence of unaligned access exceptions involving __skb_flow_dissect, __skb_get_hash_net, get_rps_cpu, or PPPoE parsing.

Typical attack path

1. Identify Linux-based systems or appliances reachable at Layer 2 via Ethernet/PPPoE traffic.
2. Confirm or assume the target may use a strict-alignment CPU architecture and kernel version containing the vulnerable flow dissector behavior.
3. Craft a PPPoE session frame with Protocol Field Compression, producing a one-byte PPP protocol field and shifted payload.
4. Send the crafted frame to the target Ethernet interface; an active PPPoE session is not required for the vulnerable parsing path in some configurations.
5. Trigger flow dissection during receive-side processing, especially where Receive Packet Steering or packet hashing is enabled.
6. Cause an unaligned access exception in the kernel, resulting in denial of service through crash, reboot, or network processing failure.

How to detect it

Look for evidence of kernel crashes or oops messages shortly after receipt of PPPoE traffic. Useful log sources include kernel ring buffer output, syslog, journald, crash dumps, netconsole, serial console logs, appliance event logs, and network packet captures from affected segments. Search for unaligned access exceptions, MIPS exception codes, and stack traces containing the Linux flow dissector receive path. In packet captures, look for PPPoE session traffic using Protocol Field Compression: EtherType 0x8864 with PPPoE session data where the PPP protocol field appears as a single byte rather than the normal two-byte field, causing the following network header to be shifted by one byte. Correlate suspicious PPPoE frames with device reboots, watchdog resets, kernel panics, interface resets, or loss of packet forwarding. Because exploitation results primarily in denial of service, host artifacts may be limited to crash logs and volatile kernel messages unless persistent crash dumping is enabled.

• __skb_flow_dissect
• __skb_get_hash_net
• get_rps_cpu
• netif_receive_skb_list_internal
• napi_complete_done
• napi_threaded_poll
• unaligned access exception
• ExcCode 04
• BadVA
• KERNEL EXL IE
• PPPoE PFC
• Protocol Field Compression
• EtherType 0x8864
• PPPoE session data with one-byte PPP protocol field
• pppoe.code == 0x00
• eth.type == 0x8864

What your security team should do

• Prioritize patching Linux kernels on network-facing appliances, routers, firewalls, broadband equipment, embedded systems, and strict-alignment architectures such as MIPS.
• Inventory systems that accept or are exposed to PPPoE/Ethernet traffic, especially interfaces on untrusted or shared Layer 2 networks.
• Where immediate patching is not possible, block unexpected PPPoE session frames or PPPoE PFC-like traffic at switches, firewalls, packet filters, or appliance ingress controls where feasible.
• Review Receive Packet Steering usage on exposed interfaces and disable it temporarily only if the availability benefit outweighs performance impact.
• Monitor kernel logs for crashes, oops traces, and unaligned access exceptions in the Linux networking receive path.
• Collect packet captures on exposed segments if unexplained crashes occur, looking for PPPoE session frames with compressed one-byte PPP protocol fields.
• Track vendor advisories for exact fixed kernel versions for each Linux distribution or appliance platform in use.