CVE-2026-93337 is an improper neutralization of argument delimiters vulnerability in NetworkManager-l2tp. Local users with permission to create VPN connections can inject arbitrary pppd directives by providing mru or mtu values containing trailing non-numeric characters after a valid integer. The vulnerability arises because these unvalidated strings are written verbatim into the pppd options file via the write_config_option() function. This allows injection of the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object, resulting in arbitrary code execution with root privileges.

Successful exploitation allows a local attacker with VPN connection creation permissions to execute arbitrary code as root by injecting malicious directives into the pppd options file. This can lead to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict VPN connection creation permissions to trusted users only to reduce the risk of exploitation.