CVE-2026-68121

Published Aug 10, 2026

Last updated 19 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-68121, also known as "PPPoEject," is a use-after-free vulnerability found within the Linux kernel's Point-to-Point Protocol over Ethernet (PPPoE) implementation. The flaw arises in the `pppoe_sendmsg()` function, where a pointer to the PPPoE header is saved prior to invoking `dev_hard_header()`. Device header callbacks have the capability to reallocate the socket buffer (skb) head, which can invalidate any previously stored pointers. If the skb head is reallocated, the PPPoE implementation subsequently writes six bytes through the now-stale pointer into memory that has already been freed. This action can lead to kernel memory corruption. The vulnerability was discovered by researcher Asim Viladi Oglu Manizada and is one of several local privilege escalation (LPE) flaws recently identified in the Linux kernel.

Description: In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after dev_hard_header() pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This can happen when a send is blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head. Reload the PPPoE header through the skb's network-header offset after device header creation. pskb_expand_head() updates that offset when it relocates the head.
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-416

Hype score: Not currently trending

References