CVE-2026-75131

Name of the Vulnerable Software and Affected Versions NetworkManager-l2tp versions 1.0 through 1.52.4

Description A privilege escalation issue exists that allows local users with permission to create VPN connections to execute arbitrary code as root. An attacker can inject pppd options by using a crafted VPN username containing a double-quote character or whitespace. This allows the attacker to break out of the pppd options file quoting context and include the pppd plugin directive, which forces the privileged pppd process to load an attacker-controlled shared object.

Recommendations Update NetworkManager-l2tp to version 1.52.6.