Local Privilege Escalation in NetworkManager-l2tp via pppd Directive Injection

CVE-2026-93337 describes an improper input validation vulnerability within NetworkManager-l2tp that facilitates privilege escalation. Local users who possess the necessary permissions to create VPN connections can manipulate the 'mru' or 'mtu' properties by appending non-numeric characters to a valid integer. The application's 'write_config_option()' function improperly validates this input and writes the entire string verbatim into the 'pppd' options configuration file.

Because the 'pppd' process runs with root privileges, this injection vector allows an attacker to insert a 'plugin' directive into the configuration file. When the 'pppd' daemon subsequently starts or reloads its configuration, it interprets this injected directive and loads an attacker-specified shared object file. This enables an unprivileged local attacker to achieve arbitrary code execution in the context of the root user, significantly impacting system integrity and confidentiality.

Impact

Successful exploitation allows a local user with standard VPN configuration permissions to escalate privileges to root. This impacts any Linux system utilizing NetworkManager-l2tp, potentially leading to full system compromise, exfiltration of sensitive credentials, or the installation of persistent rootkits.

Recommendation

1. Audit system configurations for users with VPN connection creation permissions and restrict access to strictly necessary accounts.
2. Monitor for unauthorized modifications to files located in /etc/ppp/options or other pppd configuration directories.
3. Update NetworkManager-l2tp to the patched version as soon as provided by the distribution vendor to mitigate the input validation flaw in 'write_config_option()'.
4. Implement endpoint monitoring to detect unusual 'pppd' process invocations, particularly those referencing non-standard shared object files or unexpected configuration paths.