CVE-2026-46306

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> flow_dissector: do not dissect PPPoE PFC frames<br /> <br /> RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT<br /> RECOMMENDED for PPPoE. In practice, pppd does not support negotiating<br /> PFC for PPPoE sessions, and the flow dissector driver has assumed an<br /> uncompressed frame until the blamed commit.<br /> <br /> During the review process of that commit [1], support for PFC is<br /> suggested. However, having a compressed (1-byte) protocol field means<br /> the subsequent PPP payload is shifted by one byte, causing 4-byte<br /> misalignment for the network header and an unaligned access exception<br /> on some architectures.<br /> <br /> The exception can be reproduced by sending a PPPoE PFC frame to an<br /> ethernet interface of a MIPS board, with RPS enabled, even if no PPPoE<br /> session is active on that interface:<br /> <br /> $ 0 : 00000000 80c40000 00000000 85144817<br /> $ 4 : 00000008 00000100 80a75758 81dc9bb8<br /> $ 8 : 00000010 8087ae2c 0000003d 00000000<br /> $12 : 000000e0 00000039 00000000 00000000<br /> $16 : 85043240 80a75758 81dc9bb8 00006488<br /> $20 : 0000002f 00000007 85144810 80a70000<br /> $24 : 81d1bda0 00000000<br /> $28 : 81dc8000 81dc9aa8 00000000 805ead08<br /> Hi : 00009d51<br /> Lo : 2163358a<br /> epc : 805e91f0 __skb_flow_dissect+0x1b0/0x1b50<br /> ra : 805ead08 __skb_get_hash_net+0x74/0x12c<br /> Status: 11000403 KERNEL EXL IE<br /> Cause : 40800010 (ExcCode 04)<br /> BadVA : 85144817<br /> PrId : 0001992f (MIPS 1004Kc)<br /> Call Trace:<br /> [] __skb_flow_dissect+0x1b0/0x1b50<br /> [] __skb_get_hash_net+0x74/0x12c<br /> [] get_rps_cpu+0x1b8/0x3fc<br /> [] netif_receive_skb_list_internal+0x324/0x364<br /> [] napi_complete_done+0x68/0x2a4<br /> [] mtk_napi_rx+0x228/0xfec<br /> [] __napi_poll+0x3c/0x1c4<br /> [] napi_threaded_poll_loop+0x234/0x29c<br /> [] napi_threaded_poll+0x8c/0xb0<br /> [] kthread+0x104/0x12c<br /> [] ret_from_kernel_thread+0x14/0x1c<br /> <br /> Code: 02d51821 1060045b 00000000 3084000f 2c820005 144001a2 00042080 8e220000<br /> <br /> To reduce the attack surface and maintain performance, do not process<br /> PPPoE PFC frames.<br /> <br /> [1] https://lore.kernel.org/r/20220630231016.GA392@debian.home