Use After Free in Linux

CVE-2026-68121

In the Linux kernel, the following vulnerability has been resolved:

pppoe: reload header pointer after dev_hard_header()

pppoe_sendmsg() saves a pointer to the PPPoE header before calling
dev_hard_header(). Device header callbacks are allowed to reallocate the
skb head, invalidating pointers into it.

This can happen when a send is blocked in copy_from_user() while the first
non-Ethernet port is added to an empty team device. The team's delegated
GRE header callback then expands the skb head. PPPoE subsequently writes
six bytes through the stale pointer into the freed head.

Reload the PPPoE header through the skb's network-header offset after
device header creation. pskb_expand_head() updates that offset when it
relocates the head.

Vulnerability class: Use-After-Free

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS 0.004, 30.9th percentile (scored ); unchanged over 30 days. About EPSS.

Affected products

  • Linux — versions 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 7.1.6, 7.2

Weakness classification (CWE)

Public exploits and proof-of-concept code

5 public repositories with exploit or proof-of-concept code for this CVE:

References

This CVE has public exploit evidence. See the latest CVEs with public exploits.