{"id":16000,"date":"2026-09-04T19:04:39","date_gmt":"2026-09-04T11:04:39","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-46306"},"modified":"2026-09-04T19:04:39","modified_gmt":"2026-09-04T11:04:39","slug":"cve-2026-46306","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-46306","title":{"rendered":"CVE-2026-46306 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nflow_dissector: do no"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>flow_dissector: do not dissect PPPoE PFC frames<\/p>\n<p>RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT<br \/>\nRECOMMENDED for PPPoE. In practice, pppd does not support negotiating<br \/>\nPFC for PPPoE sessions, and the flow dissector driver has assumed an<br \/>\nuncompressed frame until the blamed commit.<\/p>\n<p>During the review process of that commit [1], support for PFC is<br \/>\nsuggested. However, having a compressed (1-byte) protocol field means<br \/>\nthe subsequent PPP payload is shifted by one byte, causing 4-byte<br \/>\nmisalignment for the network header and an unaligned access exception<br \/>\non some architectures.<\/p>\n<p>The exception can be reproduced by sending a PPPoE PFC frame to an<br \/>\nethernet interface of a MIPS board, with RPS enabled, even if no PPPoE<br \/>\nsession is active on that interface:<\/p>\n<p>$ 0   : 00000000 80c40000 00000000 85144817<br \/>\n$ 4   : 00000008 00000100 80a75758 81dc9bb8<br \/>\n$ 8   : 00000010 8087ae2c 0000003d 00000000<br \/>\n$12   : 000000e0 00000039 00000000 00000000<br \/>\n$16   : 85043240 80a75758 81dc9bb8 00006488<br \/>\n$20   : 0000002f 00000007 85144810 80a70000<br \/>\n$24   : 81d1bda0 00000000<br \/>\n$28   : 81dc8000 81dc9aa8 00000000 805ead08<br \/>\nHi    : 00009d51<br \/>\nLo    : 2163358a<br \/>\nepc   : 805e91f0 __skb_flow_dissect+0x1b0\/0x1b50<br \/>\nra    : 805ead08 __skb_get_hash_net+0x74\/0x12c<br \/>\nStatus: 11000403        KERNEL EXL IE<br \/>\nCause : 40800010 (ExcCode 04)<br \/>\nBadVA : 85144817<br \/>\nPrId  : 0001992f (MIPS 1004Kc)<br \/>\nCall Trace:<br \/>\n[] __skb_flow_dissect+0x1b0\/0x1b50<br \/>\n[] __skb_get_hash_net+0x74\/0x12c<br \/>\n[] get_rps_cpu+0x1b8\/0x3fc<br \/>\n[] netif_receive_skb_list_internal+0x324\/0x364<br \/>\n[] napi_complete_done+0x68\/0x2a4<br \/>\n[] mtk_napi_rx+0x228\/0xfec<br \/>\n[] __napi_poll+0x3c\/0x1c4<br \/>\n[] napi_threaded_poll_loop+0x234\/0x29c<br \/>\n[] napi_threaded_poll+0x8c\/0xb0<br \/>\n[] kthread+0x104\/0x12c<br \/>\n[] ret_from_kernel_thread+0x14\/0x1c<\/p>\n<p>Code: 02d51821  1060045b  00000000  3084000f  2c820005  144001a2  00042080  8e220000<\/p>\n<p>To reduce the attack surface and maintain performance, do not process<br \/>\nPPPoE PFC frames.<\/p>\n<p>[1] https:\/\/lore.kernel.org\/r\/20220630231016.GA392@debian.home<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>flow_dissector: do not dissect PPPoE PFC frames<\/p>\n<p>RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT<br \/>\nRECOMMENDED<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-16000","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/16000","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16000"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16000"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16000"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}