CVE-2026-19624

NetworkManager-l2tp, the L2TP/IPsec plugin for NetworkManager on Linux, writes attacker-controlled connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that the pluto daemon loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a value with injected newlines, such as a leftupdown directive, and when the IKE security association is established pluto executes that command as root, resulting in full local privilege escalation. The bug is the same class as CVE-2018-10900 in NetworkManager-vpnc. Primarily at risk are multi-user Linux systems where unprivileged users are permitted to create or edit their own NetworkManager VPN connections (the default polkit behavior on most desktop distributions). There is no known public proof of concept, the issue is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

What to do: Apply the fixed NetworkManager-l2tp package from your distribution as soon as an update ships, since no fixed version was named in the advisory. In the interim, restrict which local users can create or modify NetworkManager connections via polkit (e.g., org.freedesktop.NetworkManager.settings.modify.system and .own) or remove the plugin from shared/multi-user hosts, and audit existing VPN profiles and generated ipsec.conf content for injected newlines or unexpected leftupdown entries. Single-user workstations are at materially lower risk because exploitation requires a local unprivileged account.