AI description
CVE-2026-68121, also known as "PPPoEject," is a use-after-free vulnerability found within the Linux kernel's Point-to-Point Protocol over Ethernet (PPPoE) implementation. The flaw arises in the `pppoe_sendmsg()` function, where a pointer to the PPPoE header is saved prior to invoking `dev_hard_header()`. Device header callbacks have the capability to reallocate the socket buffer (skb) head, which can invalidate any previously stored pointers. If the skb head is reallocated, the PPPoE implementation subsequently writes six bytes through the now-stale pointer into memory that has already been freed. This action can lead to kernel memory corruption. The vulnerability was discovered by researcher Asim Viladi Oglu Manizada and is one of several local privilege escalation (LPE) flaws recently identified in the Linux kernel.
- Description
- In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after dev_hard_header() pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This can happen when a send is blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head. Reload the PPPoE header through the skb's network-header offset after device header creation. pskb_expand_head() updates that offset when it relocates the head.
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- NVD status
- Received
CVSS 3.1
- Type
- Secondary
- Base score
- 7.8
- Impact score
- 5.9
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
13
Four Linux local-root vulns published with working PoCs. DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), DiagSpill (CVE-2026-74469). Write-up + exploits dropped after coordinated disclosure. https://t.co/K7AjqePWEf https://t.co/8RpBiQgxEN
@PadhiyarRushi
19 Sept 2026
1059 Impressions
0 Retweets
18 Likes
14 Bookmarks
2 Replies
0 Quotes
News: Asim Manizada published local-root PoCs for four Linux kernel bugs (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469). Hits unpatched multi-user hosts. Patch to a fixed kernel (6.12.109+ or your distro advisory). https://t.co/epX3rBZCdG
@snakeyesV1
19 Sept 2026
62 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Public exploits are out for four Linux kernel LPE flaws (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469). Disabling unprivileged user namespaces limits exposure until patched. https://t.co/WjH2VyXgG9 https://t.co/QC14eBVf0C #2workly
@2Workly
18 Sept 2026
2 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Cuatro fallos en el núcleo de Linux permiten acceso root Se han revelado cuatro nuevas vulnerabilidades en el núcleo de Linux ( CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 y CVE-2026-74469 ) https://t.co/1OcVOhRSPz
@elhackernet
18 Sept 2026
5499 Impressions
50 Retweets
140 Likes
29 Bookmarks
1 Reply
1 Quote
🚨 Linux kernel'de 4 kritik LPE açığı için public exploit yayınlandı! CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 ve CVE-2026-74469 için çalışan PoC / Exploit github üzerinden yayınlandı. Açıklar; IPsec AH6, TUN/TAP, PPPoE ve SCTP bileşenlerindeki bellek g
@ridvanyagli
18 Sept 2026
692 Impressions
4 Retweets
12 Likes
5 Bookmarks
0 Replies
0 Quotes
News: Four Linux kernel bugs give local root: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), DiagSpill (CVE-2026-74469). Hits many kernels. Update to 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, or 7.2.4. https://t.co/d6MF0JA29w
@snakeyesV1
18 Sept 2026
57 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2026-68121 - Linux kernel pppoe_sendmsg() use-after-free via reallocated skb header. Potential memory corruption. CVSS N/A, unpatched. Update kernels once fixed. https://t.co/AnGZs1Kr6H #CVE #Linux #infosec #infosec #cybersecurity #CVE #Linux #infosec #infosec #devsecops
@HugoValters
10 Aug 2026
105 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes