CVE-2026-39314: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-39314 is an integer underflow vulnerability in OpenPrinting CUPS affecting the _ppdCreateFromIPP() function in cups/ppd-cache.c. Any unprivileged local user can crash the cupsd root process by supplying a negative job-password-supported IPP attribute, resulting in a denial of service. All versions up to and including 2.4.16 are affected; the issue is patched in version 2.4.17. It carries a CVSS v3.1 base score of 6.2 (Medium) per Feedly/NVD, though the GitHub advisory rates it 4.0 (Moderate) (GitHub Advisory).

The root cause is an integer underflow (CWE-191) in _ppdCreateFromIPP() (cups/ppd-cache.c, lines 3504–3516). The bounds check at line 3512 only enforces an upper limit (if (maxlen > 32) maxlen = 32), so a negative value such as -1 passes validation. When cast to size_t, -1 wraps to 0xFFFFFFFFFFFFFFFF (~2^64) on 64-bit systems, and this enormous value is passed as the length argument to memset() on a 33-byte stack buffer (pattern[33]), causing an immediate SIGSEGV. The vulnerable code path is triggered via create_local_bg_thread() in scheduler/ipp.c, which runs as a background thread in the cupsd root process when a local user creates a printer via the CUPS-Create-Local-Printer IPP operation. Notably, ippValidateAttributes() does not range-check integer attribute values, so the negative value is accepted as valid IPP data (GitHub Advisory).

Successful exploitation causes an immediate, deterministic crash of the cupsd root process, resulting in a complete denial of the printing service system-wide. Because systemd's Restart=on-failure policy automatically restarts cupsd, an attacker can loop the attack for sustained, persistent denial of service. There is no confidentiality or integrity impact — the memset writes a fixed byte (0x31, ASCII '1') rather than attacker-controlled content, ruling out remote code execution (GitHub Advisory).

A proof-of-concept exploit chain is publicly documented in the GitHub security advisory, including step-by-step instructions for setting up a malicious IPP printer and triggering the crash. No authentication is required from localhost in the default CUPS policy, and the attack requires only local user access with no special privileges. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.013% (0.000130), indicating low probability of near-term exploitation. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Reconnaissance: Confirm the target system is running CUPS <= 2.4.16 and that the local user can reach the cupsd socket (default configuration on most Linux systems).
2. Set up a fake IPP printer: On localhost, start a minimal IPP server (e.g., a custom script or tool) listening on an arbitrary port (e.g., ATTACKER_PORT). Configure it to respond to Get-Printer-Attributes requests with a job-password-supported attribute set to any negative integer (e.g., -1 or -5).
3. Trigger printer creation: As an unprivileged local user, send a CUPS-Create-Local-Printer IPP request to localhost:631 with device-uri=ipp://127.0.0.1:ATTACKER_PORT/. No authentication is required in the default CUPS policy.
4. Crash cupsd: cupsd (running as root) spawns create_local_bg_thread, connects to the fake printer, and fetches attributes. ippValidateAttributes() passes the negative integer without range-checking. _ppdCreateFromIPP() reads maxlen = -1, the upper-bound check passes, and memset(pattern, '1', (size_t)(-1)) overflows the 33-byte stack buffer, causing an immediate SIGSEGV.
5. Sustain denial of service: Because systemd restarts cupsd on failure (Restart=on-failure), repeat steps 3–4 in a loop to maintain persistent denial of service, preventing all printing system-wide (GitHub Advisory).

• Logs: Repeated cupsd crash entries in /var/log/syslog, journalctl -u cups, or /var/log/cups/error_log showing SIGSEGV signals; systemd journal entries indicating frequent cups.service restarts due to failure.
• Process: Unusual short-lived cupsd process lifecycles visible via ps or process monitoring tools; rapid respawn cycles of the cupsd root process.
• Network: Unexpected IPP connections from cupsd (running as root) to unusual localhost ports not associated with known printers; short-lived TCP connections to attacker-controlled local ports.
• File System: Presence of a locally running IPP server process (e.g., a Python script or custom binary) listening on a non-standard port, potentially created by a low-privileged user (GitHub Advisory).

Upgrade OpenPrinting CUPS to version 2.4.17 or later, which adds a lower-bound check for maxlen in _ppdCreateFromIPP() to clamp negative values to zero. The fix was committed to both the master branch (commit 3d748da) and the 2.4.x branch (commit 928a86b). As a temporary workaround where upgrading is not immediately possible, restrict local user access to the cupsd socket or disable the CUPS-Create-Local-Printer operation via CUPS policy configuration. Monitoring for unexpected cupsd restarts can help detect exploitation attempts (GitHub Advisory, CUPS 2.4.17 Release).

The vulnerability was reported by researcher Tomer-PL and published by CUPS maintainer michaelrsweet on April 6, 2026, with a fix already applied at the time of disclosure. The advisory was discussed on the oss-security mailing list, and multiple Linux distributions including Ubuntu, SUSE, Slackware, Fedora, and Amazon Linux 2023 issued security advisories and updated packages. Tenable released multiple Nessus detection plugins (IDs 305257, 307661, 311327, 317701, 319997, and others) for the vulnerability (GitHub Advisory, Ubuntu Advisory, SUSE Advisory).